fix(security): default dev service port bindings to loopback

[DevipriyaS17]

Summary

This PR fixes CM-353 by changing development Docker Compose port bindings to localhost by default.

Problem

Previously, dev services were exposed on all interfaces (0.0.0.0) by default:

• Vault: 8200
• Postgres: 5432
• Console App: 8181

This increased host attack surface in local dev environments and enabled unintended network access.

Validation

Executed:

• docker compose up -d
• docker compose ps

Observed bindings:

• 127.0.0.1:8181->8181/tcp
• 127.0.0.1:8200->8200/tcp
• 127.0.0.1:5432->5432/tcp

Services are healthy and app routes initialize successfully.

To run locally

docker compose"
CONSOLE_HOST=0.0.0.0 POSTGRES_HOST=0.0.0.0 VAULT_HOST=0.0.0.0 docker compose up

go run directly
HTTP_HOST=0.0.0.0 go run ./cmd/app/ --config "./config/config.yml"

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 44.45%. Comparing base (861e864) to head (c2748e8).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1168   +/-   ##
=======================================
  Coverage   44.45%   44.45%           
=======================================
  Files         144      144           
  Lines       13732    13732           
=======================================
  Hits         6105     6105           
  Misses       7054     7054           
  Partials      573      573           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.