The control API, served on the reserved cherrypicker.localhost host:
GET /healthz → 200 {"ok":true,"version":…}
GET /routes → 200 {"routes":[{"name":…,"port":…}]}
PUT /routes/:name → 200|400, body {"port":4000}
DELETE /routes/:name → 200Loopback-only by construction: the daemon binds 127.0.0.1/::1-facing
ports and .localhost names never resolve off-machine, so the API's
trust boundary is "processes on this machine" — the same boundary any
local dev server already has.