Allow plain HTTP on private networks

[RyanLee-Dev]

Summary

• One rule in internal/origin: plain HTTP is allowed for loopback and literal private-network addresses (10/8, 172.16/12, 192.168/16, fc00::/7). Core's OAC_PUBLIC_URL check, the node identity endpoint, the daemon's remote_url and the Python node installer all use it; testdata/plain_http_hosts.json checks the Go and Python copies. E2B still needs HTTPS.
• Web: Add node and Clean up the host take the public URL Core accepted, unless it is local_only. Removed the now-unused lib/connection.ts. Copy no longer says HTTPS is required for nodes.
• install.sh: defaults OAC_PUBLIC_URL to http://<private address>:<web port> when published on 0.0.0.0, otherwise http://localhost:<web port> (this also fixes --web-port without --public-url, which left Web accepting only localhost:8080). Prints step progress instead of Compose output, the services' logs on a failed start, then the console URL, the Core key (with sudo in commands when run through sudo) and next steps.
• EN/ZH docs updated.

Test plan

• go test for origin, deployment, node, processconfig, oac, web, daemon cli
• python3 -m unittest for deploy/node and deploy/test_install.py
• Web tsc and vitest

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}