feat(security): add authentication and host binding to dashboard

This commit addresses the missing authentication vulnerability in the
dashboard server.

Changes:
- Added Basic Authentication support via TORCH_DASHBOARD_AUTH env var
  or dashboard.auth config field.
- Defaulted dashboard host binding to 127.0.0.1 for better security.
- Added --host CLI argument to allow overriding the bind address.
- Used crypto.timingSafeEqual for secure credential comparison.
- Fixed a potential crash when parsing malformed Authorization headers.
- Added comprehensive unit tests for dashboard authentication.
- Updated documentation in README.md and torch-config.example.json.

Co-authored-by: PR0M3TH3AN <[email protected]>

src/cli-parser.mjs

@@ -17,6 +17,7 @@ export function parseArgs(argv) {
     dryRun: false,
     force: false,
     port: DEFAULT_DASHBOARD_PORT,
+    host: null,
     logDir: 'task-logs',
     ignoreLogs: false,
     id: null,
@@ -65,6 +66,8 @@ export function parseArgs(argv) {
       args.force = true;
     } else if (arg === '--port') {
       args.port = parseInt(argv[++i], 10) || DEFAULT_DASHBOARD_PORT;
+    } else if (arg === '--host') {
+      args.host = argv[++i];
     } else if (arg === '--log-dir') {
       args.logDir = argv[++i];
     } else if (arg === '--ignore-logs') {