fix(security): bind orchestrator :8000 to loopback (GHSA-4f7g-w95g-5q2c)

Both deploy composes published the orchestrator API on 0.0.0.0:8000, so any
host that could reach the machine hit the control plane directly — past nginx
and, in the default header-trust posture, with no credential: read/write
runtime settings and X-Agent-Role: ceo spawn/stop. nginx reaches the API over
the internal Docker network, so a routable host publish is never needed; bind
it to 127.0.0.1. On-host debugging and normal panel operation are unchanged;
off-host access must go through nginx + cloud auth.

docker-compose.yml

@@ -415,7 +415,12 @@ services:
       - data
       - render
     ports:
-      - "8000:8000"
+      # Loopback-only: the orchestrator API is an unauthenticated control plane
+      # in header-trust mode. nginx reaches it over the internal network, so it
+      # never needs a routable host publish; remote access goes via nginx + cloud
+      # auth. A 0.0.0.0 publish exposed spawn/stop and settings-write with no
+      # credential to anyone who could reach the host (GHSA-4f7g-w95g-5q2c).
+      - "127.0.0.1:8000:8000"
     environment:
       # Database (use container name, not localhost)
       ROBOCO_DATABASE_HOST: roboco-postgres