sync: update from private repo (ddadfd71)

Dockerfile

@@ -145,10 +145,11 @@ RUN mkdir -p /app/data /workspaces \
     && chown -R node:node /app/data /workspaces config.yaml
 
 # HOST=0.0.0.0 is required INSIDE the container so the published port is
-# reachable. This is safe because docker-compose maps it to 127.0.0.1:9876 on
-# the host — the container is not exposed to the LAN unless the operator changes
-# that mapping. The app's own default (when HOST is unset, e.g. bare-metal) is
-# 127.0.0.1; see createCoreServer in src/bridge/server.ts.
+# reachable. docker-compose.yml publishes that port on ALL host interfaces by
+# default, so a Docker deployment is reachable from the LAN out of the box —
+# enabling auth/TLS before exposing it is the operator's responsibility (see
+# docs/docker.md, SECURITY.md). The app's own default (when HOST is unset, e.g.
+# bare-metal) is 127.0.0.1; see createCoreServer in src/bridge/server.ts.
 ENV NODE_ENV=production \
     PORT=9876 \
     HOST=0.0.0.0 \