Fix viewer share links to use LAN IP; bind Flask to 0.0.0.0

Share links copied from the Share modal were built with
window.location.origin, producing 127.0.0.1 URLs that remote
viewers could never reach.

- Bind Flask to 0.0.0.0 in gdpr_scanner.py (--host default),
  m365_launcher.py, and build_gdpr.py so the server is reachable
  on the local network. Internal loopback URLs (urllib exports,
  webview window, port probe) intentionally keep 127.0.0.1.
- Add /api/local_ip endpoint: UDP probe to 8.8.8.8 discovers the
  active LAN IP without sending real traffic.
- Add _getShareBaseUrl() in viewer.js: fetches /api/local_ip and
  substitutes the LAN IP; falls back to window.location.origin.
- createShareLink and copyTokenLink are now async and await
  _getShareBaseUrl() before building the viewer URL.
- Update CLAUDE.md and static/js/CLAUDE.md with the new invariants.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

gdpr_scanner.py

@@ -15,6 +15,7 @@ import base64
 import hashlib
 import io
 import json
+import socket
 import logging
 import logging.handlers
 import os
@@ -1432,6 +1433,18 @@ def _build_article30_docx() -> tuple[bytes, str]:
 
 
 
+@app.route("/api/local_ip")
+def local_ip():
+    """Return the machine's LAN IP so viewer links point to a routable address."""
+    try:
+        with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as _s:
+            _s.connect(("8.8.8.8", 80))
+            ip = _s.getsockname()[0]
+    except Exception:
+        ip = "127.0.0.1"
+    return jsonify({"ip": ip})
+
+
 @app.route("/api/scan/stream")
 def scan_stream():
     q = queue.Queue(maxsize=512)
@@ -1538,7 +1551,7 @@ Example --settings file with SMTP:
 """,
     )
     parser.add_argument("--port",     type=int, default=5100)
-    parser.add_argument("--host",     default="127.0.0.1")
+    parser.add_argument("--host",     default="0.0.0.0")
     parser.add_argument("--headless", action="store_true",
                         help="Run a non-interactive scan and export Excel, then exit")
     parser.add_argument("--output",   default=".",