fix: allow localhost HTTP in transport credential guard

The HTTPS-only credential check correctly blocks token leakage over cleartext HTTP to remote servers. However, loopback addresses (localhost, 127.0.0.1, ::1) never leave the machine, so TLS would require a self-signed cert and add friction for local development.

Add an explicit loopback exemption so `muse push` works against a local MuseHub instance (e.g. Docker on port 10003) without needing a TLS terminator.