fix: bind app to localhost:8005 for Caddy reverse proxy

Host port changed from 8080 to 8005 and bound to 127.0.0.1 only
so traffic goes through Caddy (HTTPS) instead of being exposed directly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -15,7 +15,7 @@ services:
     networks:
       - internal
     ports:
-      - "${PORT:-8080}:8080"
+      - "127.0.0.1:${PORT:-8005}:8080"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8080/api/v1/health"]
       interval: 30s