feat: always bind to 0.0.0.0

Reachability is controlled by the host firewall / compose port
publishing, not the bind address. Backend, compose, and docs all
now default to 0.0.0.0 so the API is reachable from the frontend
container, the host, and the LAN without per-env overrides.

Files:
- backend/src/cyclone/__main__.py: default host = 0.0.0.0
- docker-compose.yml: refresh the comment to match the new posture
- CLAUDE.md / README.md / docs/ARCHITECTURE.md / docs/REQUIREMENTS.md:
  reframe the bind note accordingly

backend/src/cyclone/__main__.py

@@ -1,10 +1,11 @@
 """Entry point for ``python -m cyclone``.
 
 * ``python -m cyclone`` (no args) — Click CLI (``cli.main``)
-* ``python -m cyclone serve``     — start the FastAPI app on 127.0.0.1:8000
+* ``python -m cyclone serve``     — start the FastAPI app on 0.0.0.0:8000
 
 Honors the env vars:
 
+* ``CYCLONE_HOST`` (default ``0.0.0.0`` — always bind to all interfaces)
 * ``CYCLONE_PORT`` (default ``8000``)
 * ``CYCLONE_RELOAD`` (default ``0``; set to ``1`` to enable uvicorn reload)
 """
@@ -40,12 +41,13 @@ def main() -> None:
 
     if len(sys.argv) >= 2 and sys.argv[1] == "serve":
         port = os.environ.get("CYCLONE_PORT", "8000")
-        # Local-only by default — see CLAUDE.md. The Docker image
-        # overrides to 0.0.0.0 via compose env so the frontend
-        # container on the compose bridge network can reach the
-        # backend. Network isolation is provided by the bridge
-        # network itself (only cyclone-frontend joins).
-        host = os.environ.get("CYCLONE_HOST", "127.0.0.1")
+        # Always bind to 0.0.0.0 so the API is reachable from the
+        # frontend container on the compose bridge network AND from
+        # the host (Vite dev proxy) AND from the LAN. Network isolation
+        # is provided by the host firewall / compose port publishing,
+        # not by binding to loopback. Override with CYCLONE_HOST if you
+        # have a reason to restrict.
+        host = os.environ.get("CYCLONE_HOST", "0.0.0.0")
         reload = os.environ.get("CYCLONE_RELOAD", "0") == "1"
         sys.argv = [
             sys.argv[0],