security: 端口绑定限制为 127.0.0.1 (API/Web)

infra/docker/compose.yml

@@ -52,7 +52,7 @@ services:
     # Staging: 8000 -> 8000
     # Production: 8001 -> 8000
     ports:
-      - "${API_PORT:-8000}:8000"
+      - "127.0.0.1:${API_PORT:-8000}:8000"
     
     # 共享生成文件目录
     volumes:
@@ -140,7 +140,7 @@ services:
     # Staging: 3001 -> 80
     # Production: 3002 -> 80 (通过 Nginx 反向代理)
     ports:
-      - "${WEB_PORT:-3001}:80"
+      - "127.0.0.1:${WEB_PORT:-3001}:80"
     
     networks:
       - xiaoxia-net