Use a production-capable server for self-hosted web mode

[achandra-rp]

Background

recommend-web start currently runs the Flask/Werkzeug development server. That is fine for local development, but Streamline is being positioned as an open-source personal media app similar in deployment style to Sonarr/Radarr/nzbget: a long-running local or LAN-accessible self-hosted service.

The current startup logs include Werkzeug's warning:

WARNING: This is a development server. Do not use it in a production deployment.

That warning is accurate, but it is not the right default experience for a self-hosted app.

Recommendation

Add a production-capable self-hosted web mode using Waitress.

Waitress is a good fit because it is:

• Pure Python
• Cross-platform across macOS, Linux, and Windows
• Simple enough for a single-user Flask app
• More appropriate than Flask's development server for long-running self-hosted use
• Less platform-specific than Gunicorn

Proposed behavior

• Keep ./recommend-web start as the development/local server command.
• Add ./recommend-web serve for self-hosted mode using Waitress.
• Default both commands to 127.0.0.1:5050 for safety.
• Allow explicit LAN binding with --host 0.0.0.0.
• Keep STREAMLINE_PASSWORD support and strongly recommend it whenever binding beyond localhost.

Example commands:

./recommend-web start
./recommend-web serve
./recommend-web serve --host 0.0.0.0 --port 5050

Acceptance criteria

• waitress is added as a dependency.
• recommend-web serve starts the app via Waitress.
• recommend-web start remains available for development.
• Default host is 127.0.0.1, not 0.0.0.0.
• Startup output clearly distinguishes local and LAN access.
• When host is 0.0.0.0, startup output warns users to set STREAMLINE_PASSWORD before exposing the app beyond their own machine.
• README or web usage docs explain development vs self-hosted mode.

Out of scope

• Nginx/reverse proxy setup
• TLS automation
• OAuth or multi-user auth
• Container orchestration

Those can be added later if Streamline's deployment model expands, but Waitress plus localhost-by-default is the right level for the current app.