docs: record the I12 refuse address as 127.0.0.1:1

[plusky]

PR #124 is already on main. This addresses #127, the leftover from that
PR: comments and DESIGN.md still (or in the commit message, still) told
the 127.0.0.2:1 / ENETUNREACH story, and cited a mutation-kill
(assert_ne!(ip, 127.0.0.1)) that is not in the tree.

The code uses 127.0.0.1:1. The load-bearing assertion is
assert!(addr.port() < 1024) — a bind-then-drop of an ephemeral port
fails the helper. Both refused_base_url copies and the Testing list
now say that. The red predecessor (a0f535f fails rust-macos) is
recorded as known history; main is not rewritten.

I12 is unchanged: no production code, no .without_url() change.

Adversarial review (pre-PR, two lenses)

• DESIGN accuracy (MERGE-SAFE): current mechanism is 127.0.0.1:1
  plus port() < 1024; the only 127.0.0.2 mention is history of
  a0f535f. Follow-up nit: bind(:0) spelled as bind(127.0.0.1:0).
• I12 evidence (MERGE-SAFE): production sanitization untouched;
  both helpers still carry port() < 1024; copies did not drift.

Verification: all five AGENTS.md commands green.

Closes #127