feat(server): allow configuring the listen address

Allow native and host-network deployments to select an IPv4 or IPv6 bind
address through HOST while preserving the existing wildcard default.
Keep Docker health checks aligned with the configured listener and document
how to restrict host port publishing independently of the container address.
Cover validation, real bootstrap sockets, and health-check commands with tests.

Closes #1315

Dockerfile

@@ -80,7 +80,13 @@ RUN sed -i 's/\r$//' /app/entrypoint.sh && chmod +x /app/entrypoint.sh /app/bin/
 EXPOSE 3000
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
-  CMD wget -q -T 4 -O /dev/null "http://127.0.0.1:${PORT:-3000}/api/v1/health"
+  CMD host="$(printf '%s' "${HOST:-}" | tr -d '[:space:]')"; \
+      case "$host" in \
+        ''|0.0.0.0) host=127.0.0.1 ;; \
+        ::) host='[::1]' ;; \
+        *:*) host="[$host]" ;; \
+      esac; \
+      wget -q -T 4 -O /dev/null "http://${host}:${PORT:-3000}/api/v1/health"
 
 ENTRYPOINT ["/sbin/tini", "-s", "--"]
 CMD ["sh", "/app/entrypoint.sh"]