fix: match ephemeral server address family - #896

Summary

• build Supertest request URLs from the test server's bound address family
• translate wildcard listeners to the matching loopback address
• add a deterministic dual-stack regression that proves requests cannot be routed to a foreign IPv4 listener

Background

serverAddress() currently starts an ephemeral server with listen(0) but always connects to 127.0.0.1. On macOS, Node commonly binds that server to the IPv6 wildcard. A separate process can own the same port specifically on IPv4, causing Supertest's request to reach the foreign process.

This keeps the existing synchronous ephemeral bind and uses only public Node APIs. IPv6 addresses are bracketed for URL construction, and wildcard addresses are converted to their same-family loopback equivalents.

Fixes #894

Testing

• npm test on Node 24: 131 passing, including lint and coverage
• full 131-test suite: 20 consecutive passing runs on Node 24
• full 131-test suite: passing on Node 22
• regression verified to fail before the source change by receiving foreign-server instead of supertest-server