chore(docker-compose): tighten host port exposure (LAN-safe defaults)

[neoneye]

Summary

The compose stack used Docker's short-form ports: everywhere, which binds the host side to 0.0.0.0. Combined with several permissive defaults (admin/admin on the frontend, PLANEXE_MCP_REQUIRE_AUTH=false with no API key on mcp_cloud, default planexe/planexe postgres credentials, no auth at all on worker_plan), the whole stack was reachable from the LAN out of the box. This PR closes that and also drops host port mappings for the two services that nothing outside the docker network should ever call.

Changes (docker-compose.yml)

• database_postgres — ports: removed entirely. Reachable as database_postgres:5432 inside the docker network. Side benefit: no more host-side collision with a developer's local Postgres on 5432; the prior PLANEXE_POSTGRES_PORT=5433 workaround is no longer needed.
• worker_plan — ports: removed entirely. frontend_multi_user reaches it as worker_plan:8000 inside the docker network.
• frontend_multi_user (5001) and mcp_cloud (8001) — still published, now bound to ${PLANEXE_BIND_HOST:-127.0.0.1}.
• New "Published ports / bind host" comment block at the top of the file documenting the convention.

Docs (docker-compose.md)

• TL;DR rewritten.
• Old "Port conflict with local Postgres" section replaced by the new "Published ports / bind host" section, including a worked docker-compose.override.yml example for ad-hoc host access (DBeaver, psql, curl to worker_plan) during debugging.
• Per-service notes and the example docker compose ps output updated to match.

Opting back into LAN access

For the two published services (testing on phone, Claude Desktop on another machine):

export PLANEXE_BIND_HOST=0.0.0.0
docker compose up

…after also setting strong PLANEXE_FRONTEND_MULTIUSER_ADMIN_PASSWORD, PLANEXE_MCP_API_KEY, and PLANEXE_MCP_REQUIRE_AUTH=true.

To poke at the unpublished services from the host, either docker compose exec or drop a docker-compose.override.yml (template in the docs).

Test plan

• docker compose config shows only frontend_multi_user and mcp_cloud published, both with host_ip: 127.0.0.1
• database_postgres / worker_plan no longer have a published: entry in docker compose config
• Stack comes up clean via ./rebuild.sh even on a host with a local Postgres listening on 5432 (the conflict that motivated this change)
• http://127.0.0.1:5001 still serves the frontend
• PLANEXE_BIND_HOST=0.0.0.0 docker compose up makes frontend reachable from another LAN device