Enrol over http only to loopback; serve the API docs to this machine

The enrolment exemption covered any *.local host, which mDNS answers with
whoever claims it; it is now localhost, 127.0.0.0/8 and ::1. /docs, /redoc
and openapi.json stay closed in production and otherwise answer only a
loopback caller unless API_DOCS_ENABLED is set, which the dev compose does,
so `fluksio serve --host 0.0.0.0` no longer hands the schema to the network.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

docs/code/api.md

@@ -30,8 +30,9 @@ Agents authenticate differently; see [Agents over MCP](agents.md).
 
     When `ENVIRONMENT` is not `production`, the full OpenAPI schema is at
     `/docs` (Swagger) and `/redoc`, and the raw document at
-    `/api/v1/openapi.json`. That is the authoritative reference; this page is
-    the tour.
+    `/api/v1/openapi.json`, for a browser on the engine's own machine (or any,
+    with `API_DOCS_ENABLED=true`). That is the authoritative reference; this
+    page is the tour.
 
     It is closed in production: the schema enumerates every endpoint the
     instance serves, including paths webhook nodes mounted at runtime.
@@ -260,4 +261,5 @@ stored version moved past the one you were editing. Re-read, merge, save again.
 
 The frontend's TypeScript client is generated from the OpenAPI schema
 (`make generate-client`). Any OpenAPI generator will do the same for your
-language: point it at `/api/v1/openapi.json` on a non-production instance.
+language: point it at `/api/v1/openapi.json` on a non-production instance,
+from the machine it runs on.