feat: always bind to 0.0.0.0

Reachability is controlled by the host firewall / compose port
publishing, not the bind address. Backend, compose, and docs all
now default to 0.0.0.0 so the API is reachable from the frontend
container, the host, and the LAN without per-env overrides.

Files:
- backend/src/cyclone/__main__.py: default host = 0.0.0.0
- docker-compose.yml: refresh the comment to match the new posture
- CLAUDE.md / README.md / docs/ARCHITECTURE.md / docs/REQUIREMENTS.md:
  reframe the bind note accordingly

docker-compose.yml

@@ -43,10 +43,11 @@ services:
       # embedding the secret in the compose file.
       CYCLONE_ADMIN_USERNAME_FILE: "/run/secrets/cyclone_admin_username"
       CYCLONE_ADMIN_PASSWORD_FILE: "/run/secrets/cyclone_admin_password"
-      # Bind 0.0.0.0 so the frontend container on the compose bridge
-      # network can reach us. The bridge network provides isolation —
-      # only the `frontend` service is on it; the host firewall still
-      # blocks anything that isn't on the LAN.
+      # Always bind to 0.0.0.0. The compose-managed bridge network
+      # isolates the backend from the host's LAN/WAN — only the
+      # `frontend` service joins it. Host firewall / port publishing
+      # is the layer that controls what reaches us from outside the
+      # compose network, not the bind address.
       CYCLONE_HOST: "0.0.0.0"
     secrets:
       - cyclone_db_key