Is there any way I can limit a folder (and everything recursively down) in my webroot to local access only (i.e. requests from 127.0.0.1)?
You need to add the role service "IP and Domain Restrictions" to your server first.
Once that is installed:
That should do it for you.