compose: bind 8132 to localhost only

NPM proxies to scout-website:8000 over arrstack_arr_net, so the 0.0.0.0 publish
only provided a LAN path that bypassed the proxy, its exploit blocking and its
real-client-IP logging.

docker-compose.yml

@@ -19,7 +19,9 @@ services:
     container_name: scout-website
     restart: unless-stopped
     ports:
-      - "8132:8000"
+      # localhost only: NPM reaches this as scout-website:8000 over the docker
+      # network, so publishing on 0.0.0.0 only bought a LAN path around the proxy.
+      - "127.0.0.1:8132:8000"
     environment:
       - NTFY_URL=${NTFY_URL}
       - SHEET_ID=${SHEET_ID}