Compose in ZimaOS x-casaos format; allow LAN hostnames via ALLOWED_HOSTS=*

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app.py

@@ -103,6 +103,7 @@ class H(BaseHTTPRequestHandler):
         self.send_response(code); self.send_header("Content-Type", ctype); self.send_header("Content-Length", str(len(b)))
         self.send_header("Cache-Control", "no-store"); self.end_headers(); self.wfile.write(b)
     def _ok_host(self):
+        if "*" in EXTRA_HOSTS: return True   # LAN/NAS use: any hostname or IP (the app has no login, so keep it on a trusted network)
         h = self.headers.get("Host", ""); return h.rsplit(":", 1)[0] in {"127.0.0.1", "localhost"} | EXTRA_HOSTS or h in EXTRA_HOSTS
     def do_GET(self):
         if not self._ok_host(): return self._send(403, {"error": "forbidden"})