4fb768fcda
connect() and is_trusted_peer() each spelled out the same "network-exposed token bind with no allow-list" condition; drift between the two would let the startup warning and the actual refusal disagree. Extract A2ASecurityContext.dispatch_fails_closed() and use it in both places (truth table unchanged). Also hoist the is_loopback_host import to module top (no cycle) and drop the restating docstring.