_verify_assertion_token now takes expected_host and rejects any token
whose bundle["host"] does not match — closing the cross-server replay
path where a token issued for server-a could have passed on server-b.
ServerState gains protected_host (default 127.0.0.1); k_server exposes
--protected-host CLI flag so operators declare which host they protect.
New abuse tests (unit + round-trip):
test_cross_server_replay_rejected
test_cross_server_replay_case_insensitive
test_roundtrip_cross_server_replay_rejected
test_roundtrip_cross_server_replay_accepted_on_correct_server
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
592af0c314