Let local and demo listen on loopback when run on a host (B05)

[AsyncAssassin]

Summary

B05 from the merged review of v0.4.0; 0.4.1 is released once all fixes are merged. The README quickstart starts local and demo with ./gradlew bootRun, and both listened on every interface. Anyone on the same network could use local without credentials, and demo with its published passwords. Round 1 closed this for compose only.

• application-local.yml and application-demo.yml set server.address: ${SERVER_ADDRESS:127.0.0.1}. SERVER_ADDRESS=0.0.0.0 opens a remote demo on a trusted network, and never local. prod is unchanged.
• The Docker image sets SERVER_ADDRESS=0.0.0.0. A container is reached through its published port, which docker-compose.yml keeps on the host's loopback, so compose works as before.

The README environment table and remote-demo paragraph, docs/architecture.md, and docs/testing.md describe it. CHANGELOG.md lists it under [Unreleased] → Security.

Verification

• ./gradlew clean check: 273 tests, 0 failures, 2 skipped (the env-gated Alchemy live smoke).

• LoopbackBindingIntegrationTests boots local and demo against its own PostgreSQL and reads the address Tomcat's connector is bound to. It is 127.0.0.1 for both, and 0.0.0.0 for demo with SERVER_ADDRESS=0.0.0.0. Without the profile change the test fails, because the address is unset.

• Live, lsof on the listening socket, the main jar against this branch:

  Run	main	This branch
  local with java -jar	*:18202	127.0.0.1:18202
  demo with java -jar	*:18202	127.0.0.1:18202
  demo with SERVER_ADDRESS=0.0.0.0	*:18202	*:18202

• docker compose up --build in the default local profile, as its own compose project on spare ports: health answers 200 through the published 127.0.0.1:18203, and the container runs with SERVER_ADDRESS=0.0.0.0.

This PR and #15 to #19 each add a section under [Unreleased] in CHANGELOG.md, so each later merge needs a one-file rebase. The other files merge cleanly with all of them; the new lines in application-demo.yml sit at the top of the file, away from the lines #15 changes.

[AsyncAssassin]

Combined into #23 together with the other batch-1 fixes, so they merge without a rebase per PR. This description keeps the detailed evidence for its fix.