fix(web): address latest Copilot review points

pkg/netbind/netbind.go

@@ -538,18 +538,38 @@ func openAdaptiveLoopbackGroup(allowIPv6, allowIPv4 bool, port string) ([]net.Li
 }
 
 func openAdaptiveAnyGroup(port string) ([]net.Listener, []string, string, error) {
-	// Intentionally bind tcp/:: here. Go's compatibility layer handles dual-stack
+	hasIPv4, hasIPv6 := DetectIPFamilies()
-	// wildcard binding where the platform supports it, while tcp4 remains the
+
-	// fallback for IPv4-only environments.
+	if hasIPv4 && hasIPv6 {
-	if ln, actualPort, err := openExactListener(exactBinding{host: "::", network: "tcp"}, port); err == nil {
+		if ln6, actualPort, err6 := openExactListener(
-		return []net.Listener{ln}, []string{"::"}, actualPort, nil
+			exactBinding{host: "::", network: "tcp6", v6Only: true},
+			port,
+		); err6 == nil {
+			if ln4, _, err4 := openExactListener(
+				exactBinding{host: "0.0.0.0", network: "tcp4"},
+				actualPort,
+			); err4 == nil {
+				return []net.Listener{ln6, ln4}, []string{"::", "0.0.0.0"}, actualPort, nil
+			}
+			_ = ln6.Close()
+		}
 	}
 
-	ln4, actualPort, err := openExactListener(exactBinding{host: "0.0.0.0", network: "tcp4"}, port)
+	if hasIPv6 {
-	if err != nil {
+		ln6, actualPort, err := openExactListener(exactBinding{host: "::", network: "tcp6", v6Only: true}, port)
-		return nil, nil, "", fmt.Errorf("failed to open adaptive any-host listener on port %s", port)
+		if err == nil {
+			return []net.Listener{ln6}, []string{"::"}, actualPort, nil
 		}
+	}
+
+	if hasIPv4 {
+		ln4, actualPort, err := openExactListener(exactBinding{host: "0.0.0.0", network: "tcp4"}, port)
+		if err == nil {
 			return []net.Listener{ln4}, []string{"0.0.0.0"}, actualPort, nil
+		}
+	}
+
+	return nil, nil, "", fmt.Errorf("failed to open adaptive any-host listener on port %s", port)
 }
 
 func openExactListener(binding exactBinding, port string) (net.Listener, string, error) {

pkg/netbind/netbind_test.go

@@ -92,6 +92,17 @@ func TestOpenPlan_DefaultAnySupportsDualStackLoopback(t *testing.T) {
 	if hasIPv4 {
 		requireHTTPReachable(t, "127.0.0.1", port)
 	}
+
+	switch {
+	case hasIPv4 && hasIPv6:
+		if len(result.BindHosts) != 2 {
+			t.Fatalf("len(BindHosts) = %d, want 2 (%#v)", len(result.BindHosts), result.BindHosts)
+		}
+	case hasIPv6 || hasIPv4:
+		if len(result.BindHosts) != 1 {
+			t.Fatalf("len(BindHosts) = %d, want 1 (%#v)", len(result.BindHosts), result.BindHosts)
+		}
+	}
 }
 
 func TestOpenPlan_ExplicitIPv6AnyIsIPv6Only(t *testing.T) {

web/backend/app_runtime.go

@@ -35,9 +35,6 @@ func shutdownApp() {
 	}
 
 	if len(servers) > 0 {
-		ctx, cancel := context.WithTimeout(context.Background(), shutdownTimeout)
-		defer cancel()
-
 		for _, srv := range servers {
 			if srv == nil {
 				continue
@@ -46,7 +43,11 @@ func shutdownApp() {
 			// Disable keep-alive to allow graceful shutdown
 			srv.SetKeepAlivesEnabled(false)
 
-			if err := srv.Shutdown(ctx); err != nil {
+			ctx, cancel := context.WithTimeout(context.Background(), shutdownTimeout)
+			err := srv.Shutdown(ctx)
+			cancel()
+
+			if err != nil {
 				// Context deadline exceeded is expected if there are active connections
 				// This is not necessarily an error, so log it at info level
 				if errors.Is(err, context.DeadlineExceeded) {

web/backend/main.go

@@ -298,7 +298,7 @@ func launcherConsoleHostsWithLocalAddrs(
 	return hosts
 }
 
-func launcherConsoleHosts(_ []string, hostInput string, public bool) []string {
+func launcherConsoleHosts(hostInput string, public bool) []string {
 	return launcherConsoleHostsWithLocalAddrs(
 		hostInput,
 		public,
@@ -572,7 +572,7 @@ func main() {
 
 	// Print startup banner and token (console mode only).
 	if enableConsole || debug {
-		consoleHosts := launcherConsoleHosts(openResult.BindHosts, hostInput, effectivePublic)
+		consoleHosts := launcherConsoleHosts(hostInput, effectivePublic)
 
 		fmt.Print(utils.Banner)
 		fmt.Println()