Function is_lan_source 

fn is_lan_source(addr: &SocketAddr) -> bool

Trust-boundary check for the UDP responder: is addr reachable only from a private/link-local network, i.e. plausibly on this LAN? Unlike mDNS (link-local multicast, structurally non-routable off-subnet), this socket binds 0.0.0.0 and would otherwise answer any routable unicast probe with auth_key — an internet-facing disclosure oracle / UDP reflection vector if the port is ever reachable externally (port forward, hairpin NAT). Mirrors the private/loopback/link-local classification used for the opposite purpose (SSRF egress checks) in drone/executor/blocks/api.rs::is_reserved_v4/is_reserved_v6, minus the broadcast/unspecified/multicast cases that don’t apply to a source addr.