fix(SEC-ORCH-20): Bind orchestrator to 127.0.0.1 by default

Change default bind address from 0.0.0.0 to 127.0.0.1 to prevent
the orchestrator API from being exposed on all network interfaces.
The bind address is now configurable via HOST or BIND_ADDRESS env
vars for Docker/production deployments that need 0.0.0.0.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/orchestrator/src/main.ts

@@ -10,10 +10,11 @@ async function bootstrap() {
   });
 
   const port = process.env.ORCHESTRATOR_PORT ?? 3001;
+  const host = process.env.HOST ?? process.env.BIND_ADDRESS ?? "127.0.0.1";
 
-  await app.listen(Number(port), "0.0.0.0");
+  await app.listen(Number(port), host);
 
-  logger.log(`🚀 Orchestrator running on http://0.0.0.0:${String(port)}`);
+  logger.log(`🚀 Orchestrator running on http://${host}:${String(port)}`);
 }
 
 void bootstrap();