Get device IP addresses (for splash poll)

Lightweight IP-list endpoint for the splash page to poll.

Unauth'd because the splash page itself is unauth'd and the viewer isn't a credentialed client. The data here is already disclosed by /splash-page rendering — there's no new exposure.

Narrow on purpose: only IPs, no diagnostics. /api/v2/info covers the "everything about the device" case but is auth'd and does heavier work (psutil, statvfs, version checks) that would compound on a 2-second poll. Don't bolt onto this; add a sibling endpoint if a different unauth'd value is ever needed.

KNOWN LIMITATION (deferred to broader auth work). This GET has a side effect — _resolve_node_ip calls _publish_refresh() on cache miss / hit / empty-list, which publishes hostcmd: set_ip_addresses to host_agent. host_agent.set_ip_addresses in turn does an internet probe (requests.get to 1.1.1.1 with a 10×1s tenacity retry). An unauthenticated LAN client can drive that side effect at the debounce-bounded rate (one publish per _IP_REFRESH_DEBOUNCE_S).

The mitigations already in place keep blast radius bounded:

• SETNX-debounced publishes (only one refresh per 12s window regardless of poll volume),
• the response body carries no data not already disclosed by the splash page itself,
• host_agent's own retry/throttle behavior caps the downstream cost.

The proper fix is a shared internal-auth gate (matching the one on AssetRecheckViewV2) — but the splash polling endpoint is consumed by the viewer's webview from the device's local network with no way to attach BasicAuth, so internal-auth here needs to be designed alongside the broader auth rework. Tracked in the same followup as AssetRecheckViewV2's gating.