修复认证挑战与可信代理安全边界（07-17-auth-challenge-trusted-proxy-hardening）

deploy/trialrun/docker-compose.yml

@@ -69,7 +69,7 @@ services:
       NODE_ENV: production
       BUILD_SHA: ${BUILD_SHA:?set BUILD_SHA to the approved full commit}
     ports:
-      - "3000:3000"
+      - "127.0.0.1:3000:3000"
     volumes:
       - ./data/storage:${STORAGE_DIR}