Clarify Docker local-only bind settings for SQLite compose

[nh59yytyd5-dev]

Repro steps

1. Clone the repository.
2. Copy .env.sqlite.example to .env.
3. For local-only access, set CODEX_BIND=127.0.0.1 as suggested by the .env.sqlite.example comment.
4. Start the lightweight Docker deployment with docker compose -f docker-compose.sqlite.yml up -d.
5. Run curl http://127.0.0.1:8080/health.

Observed behavior

The container starts and logs Listen: 127.0.0.1:8080, but the host request returns curl: (52) Empty reply from server. Docker port publishing cannot reach the service because the process only listens on the container loopback interface.

Expected behavior

For Docker deployments, the app should listen on 0.0.0.0 inside the container while host exposure is restricted with the compose host bind setting. Local-only host access works with:

BIND_HOST=127.0.0.1
CODEX_BIND=0.0.0.0

Affected files/commands

• .env.sqlite.example comment around CODEX_BIND
• docker-compose.sqlite.yml port mapping uses ${BIND_HOST:-0.0.0.0}
• Same pattern appears in other compose files

Temporary workaround used

Keep BIND_HOST=127.0.0.1 for host-side restriction and leave CODEX_BIND=0.0.0.0 inside the container. After recreating the container, /health returns {"available":0,"status":"ok","total":0}.