For SNF4SA, is it possible to run SNFServer on 0.0.0.0:9001 instead of 127.0.0.1:9001?

Technically, you could do this by modifying the code. However, SNFServer will still need to access the temporary file that was produced by SNF4SA on the calling system. SNFServer is currently designed/licensed to live on the MTA.