v0.2.2 — IBKR gateway port (5000) published to host loopback

Added

• Host access to the IBKR Client Portal Gateway — publish the gateway's web UI
  (clientportal.gw binds :5000 inside the container) to the host loopback only
  (127.0.0.1:5000:5000), matching the db sidecar's never-public posture. The egress
  firewall does not block this inbound path: the host connection arrives sourced from
  the Docker bridge gateway (172.x.0.1), which is inside CONTAINER_CIDR, so
  init-firewall.sh's INPUT allow accepts it in every mode. Applying it needs a
  container recreate (docker compose up -d / make rebuild), and the gateway's own
  root/conf.yaml ips.allow must include 172.* or it rejects the login at the app
  layer.