fix(rpc): refuse plaintext-remote RPC by default and tighten isLocalHost

F8 (security). Two related fixes to how the wallet decides whether an RPC target is
safe to send Basic-auth credentials to:

- isLocalHost() was matching any host that merely *starts* "127." via
  rfind("127.",0)==0, so "127.evil.com" (and "127.0.0.1.attacker", "127.300.0.1",
  "1270.0.0.1") were misclassified as loopback and treated as local. It now uses a
  strict isExactIPv4Loopback() parser: exactly four 0-255 dot-separated octets with
  the first == 127. localhost / ::1 / [::1] handling is unchanged.

- A remote rpchost over plain HTTP (no rpctls=1) previously only produced a
  dismissible warning and then sent rpcuser:rpcpassword in cleartext, where a
  local-network MITM could capture them. tryConnect() now REFUSES that connection
  (clear status line + one-time notification, no creds sent) unless the user opts in
  explicitly with rpcallowplaintext=1 in DRAGONX.conf (new
  ConnectionConfig::allow_plaintext_remote, parsed in parseConfFile; policy in the
  new allowsPlaintextRemote()). Local/embedded daemons and rpctls=1 remotes are
  unaffected.

BREAKING: a wallet configured for remote plaintext RPC will stop connecting until
rpcallowplaintext=1 (or rpctls=1) is added to DRAGONX.conf. Must be called out in the
release notes. The Settings-toggle UI is deferred (the conf-key opt-in is the recovery
path; see docs/daemon-startup-hardening.md).

Adds testIsLocalHost and testAllowsPlaintextRemote to test_phase4.cpp; one i18n key
(English) added to i18n.cpp.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/rpc/connection.h

@@ -29,6 +29,7 @@ struct ConnectionConfig {
     std::string proxy;  // SOCKS5 proxy for Tor
     bool use_embedded = true;
     bool use_tls = false;
+    bool allow_plaintext_remote = false;  // rpcallowplaintext=1 — opt in to plaintext creds to a remote host
     AuthSource auth_source = AuthSource::Missing;
     // Non-empty when autoDetectConfig() could not create the data directory; callers
     // should surface it and abort the connect rather than proceeding blindly.
@@ -132,6 +133,11 @@ public:
      */
     static bool usesPlaintextRemote(const ConnectionConfig& config);
 
+    // Whether plaintext credentials to a remote host are explicitly allowed (opt-in via the
+    // DRAGONX.conf rpcallowplaintext key). Off by default: usesPlaintextRemote() && !this
+    // means the connect is refused.
+    static bool allowsPlaintextRemote(const ConnectionConfig& config);
+
     static const char* authSourceName(AuthSource source);
 
 private: