Bind published ports to localhost, stop publishing MongoDB, fix frontend healthcheck

- Bind backend, frontend and mongo-express to 127.0.0.1; nginx on the host
  proxies to them.
- Stop publishing MongoDB (27017); services reach it over the compose network.
- Override the frontend healthcheck to use 127.0.0.1 (nginx listens on IPv4
  only, so localhost -> ::1 always failed).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -6,8 +6,6 @@ services:
     image: mongo:7.0
     container_name: scoffer-mongodb
     restart: unless-stopped
-    ports:
-      - "${MONGODB_PORT:-27017}:27017"
     volumes:
       - mongodb_data:/data/db
       - ./backend/seedData.js:/docker-entrypoint-initdb.d/01-seedData.js:ro
@@ -35,7 +33,7 @@ services:
       - JWT_SECRET=${JWT_SECRET}
       - ALLOW_REGISTRATION=${ALLOW_REGISTRATION:-true}
     ports:
-      - "${BACKEND_PORT:-5000}:5000"
+      - "127.0.0.1:${BACKEND_PORT:-5000}:5000"
     depends_on:
       mongodb:
         condition: service_healthy
@@ -57,9 +55,16 @@ services:
     environment:
       - REACT_APP_API_URL=${REACT_APP_API_URL:-http://backend:5000/api}
     ports:
-      - "${FRONTEND_PORT:-3000}:80"
+      - "127.0.0.1:${FRONTEND_PORT:-3000}:80"
     depends_on:
       - backend
+    # nginx in the image listens on IPv4 only; "localhost" resolves to ::1
+    healthcheck:
+      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://127.0.0.1:80/ || exit 1"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
+      start_period: 5s
     networks:
       - recipe-network
 
@@ -69,7 +74,7 @@ services:
     container_name: scoffer-mongo-express
     restart: unless-stopped
     ports:
-      - "${MONGO_EXPRESS_PORT:-8081}:8081"
+      - "127.0.0.1:${MONGO_EXPRESS_PORT:-8081}:8081"
     environment:
       ME_CONFIG_MONGODB_URL: mongodb://mongodb:27017/
       ME_CONFIG_BASICAUTH: "false"