Enrol over http only to loopback; serve the API docs to this machine

The enrolment exemption covered any *.local host, which mDNS answers with
whoever claims it; it is now localhost, 127.0.0.0/8 and ::1. /docs, /redoc
and openapi.json stay closed in production and otherwise answer only a
loopback caller unless API_DOCS_ENABLED is set, which the dev compose does,
so `fluksio serve --host 0.0.0.0` no longer hands the schema to the network.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

docs/reference/configuration.md

@@ -112,6 +112,7 @@ remember it is fixed at build time: changing it means rebuilding that image.
 |---|---|---|
 | `ENVIRONMENT` | `local` | `local`, `staging` or `production` |
 | `PRIVATE_API_ENABLED` | `false` | unauthenticated test-only endpoints; needs `ENVIRONMENT=local` too |
+| `API_DOCS_ENABLED` | `false` | serves `/docs`, `/redoc` and the OpenAPI document to any caller; otherwise only to one on this machine. Never in `production` |
 | `SIGNUP_ENABLED` | `false` | lets anyone who reaches the login page create an account; otherwise a superuser adds them under **Admin** |
 | `TZ` | `UTC` | the timezone every schedule is written in |
 
@@ -123,7 +124,9 @@ instance is.
 
 `production` closes `/docs`, `/redoc` and the OpenAPI document, because the
 schema enumerates every endpoint the instance serves, including the paths
-webhook nodes mounted at runtime. It also turns a `changethis` secret from a
+webhook nodes mounted at runtime. Elsewhere they answer a caller on the
+engine's own machine, so `fluksio serve --host 0.0.0.0` does not hand them to
+the network; `API_DOCS_ENABLED` opens them to everyone, as the dev stack does. It also turns a `changethis` secret from a
 warning into a refusal to start.
 
 ## The engine