Add development mode bypass for localhost authentication

- Add isDevelopmentMode() function to check for localhost
- Allow localhost requests without API key in dev mode
- Enables web interface to work without auth configuration
- Production deployments still require API keys

This allows the web UI to function on localhost:8000 without
requiring developers to configure API keys for local testing.

Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>

auth.php

@@ -15,6 +15,11 @@
  * @return bool True if authenticated, false otherwise
  */
 function authenticate() {
+    // Development mode: allow localhost without auth
+    if (isDevelopmentMode()) {
+        return true;
+    }
+
     $api_key = extractApiKey();
 
     if (!$api_key) {
@@ -27,6 +32,18 @@ function authenticate() {
     return in_array($api_key, $valid_keys, true);
 }
 
+/**
+ * Check if running in development mode (localhost)
+ *
+ * @return bool True if development mode
+ */
+function isDevelopmentMode() {
+    $host = $_SERVER['HTTP_HOST'] ?? $_SERVER['SERVER_NAME'] ?? 'unknown';
+
+    // Allow localhost and 127.0.0.1 without auth
+    return in_array($host, ['localhost:8000', 'localhost', '127.0.0.1:8000', '127.0.0.1']);
+}
+
 /**
  * Extract API key from request
  *