Server hardening: finite numbers, open servers, unkickable host, no URL leaks

- Reject non-finite numerics at protocol parse and in the engine
  (a 1e400 seek became Infinity and broke every broadcast).
- Reject empty swaps; sanitize URL-looking media names.
- Blank password = open server; defaults no longer 'change-me'.
- Loopback peers (the in-process host) can't be kicked.
- /health no longer exposes media/transport; file URLs use the
  host the client dialled instead of 127.0.0.1.
- Count served bytes as streamed, not as requested.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/server/bin/server.dart

@@ -8,10 +8,10 @@ import 'package:sync_relay_server/server.dart';
 Future<void> main(List<String> args) async {
   final parser = ArgParser()
     ..addOption('port', abbr: 'p', defaultsTo: '8080')
-    ..addOption('secret', defaultsTo: 'change-me')
+    ..addOption('secret', defaultsTo: '')
     ..addOption('name', defaultsTo: 'room')
     ..addOption('media', defaultsTo: '')
-    ..addOption('advertise-host', defaultsTo: '127.0.0.1')
+    ..addOption('advertise-host', defaultsTo: '')
     ..addOption('config')
     ..addFlag('help', abbr: 'h', negatable: false);
   final parsed = parser.parse(args);