Bundled admin interfaces now bind to loopback by default

The bundled monitoring, identity, and routing interfaces (Grafana, Prometheus, Uptime Kuma, the proxy dashboard, the secret store, the directory server, and the SSO console) now bind to 127.0.0.1 on the Docker host instead of every interface. Self-hosted deployments that exposed the Docker host to the public internet were previously reachable on these ports without authentication or with unrotated default credentials.

Self-hosted operators who need remote access to these interfaces must set ADMIN_BIND to the desired interface in .env. The user-facing chat UI continues to bind to all interfaces by design.