fix: bind Gitea to 127.0.0.1 only — not exposed to internet

nginx proxy manager reaches it via localhost. No reason to bind to all interfaces.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

gitea/docker-compose.yml

@@ -4,7 +4,7 @@ services:
     container_name: gitea
     restart: always
     ports:
-      - "3100:3000"
+      - "127.0.0.1:3100:3000"
     volumes:
       - /data/server-infra/gitea:/data
       - /etc/timezone:/etc/timezone:ro