Bind published app port to localhost

nginx on the host proxies to it, so it does not need to be reachable on the
LAN directly.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -18,7 +18,7 @@ services:
       - BASIC_AUTH_PASS=${BASIC_AUTH_PASS}
     ports:
       # Select host port via APP_PORT env var; default 3000
-      - "${APP_PORT:-3000}:3000"
+      - "127.0.0.1:${APP_PORT:-3000}:3000"
     volumes:
       # Persist cache JSON files using a named volume
       - magikarp-data:/app/data