fix: allow localhost alarm reports without token

agent/internal/httpapi/alarms.go

@@ -41,7 +41,8 @@ func (s *Server) handleAlarmReport(w http.ResponseWriter, r *http.Request) {
 		errorJSON(w, http.StatusMethodNotAllowed, "method not allowed")
 		return
 	}
-	if !s.authorize(r, true) {
+	// Allow localhost requests without token (media-server alarm callback)
+	if !isLocalhost(r) && !s.authorize(r, true) {
 		errorJSON(w, http.StatusUnauthorized, "unauthorized")
 		return
 	}
@@ -181,3 +182,8 @@ func randomHex(n int) string {
 	rand.Read(b)
 	return hex.EncodeToString(b)[:n]
 }
+
+func isLocalhost(r *http.Request) bool {
+	ip := remoteIP(r)
+	return ip == "127.0.0.1" || ip == "::1" || ip == "localhost"
+}