Fix four defects in langfuse-compose found deploying Phase 2

Bind address, and the reason this matters most. Langfuse is a Next.js
standalone server: it binds to whatever $HOSTNAME resolves to, not to all
interfaces. The container is on two networks and its hostname resolved to the
proxy address, so it listened on proxy only - HTTP 200 from proxy, HTTP 000
from ai-internal. Caddy is on proxy, so the public URL worked perfectly and
nothing looked wrong, but ai-api runs on ai-internal and every trace it sent
would have failed silently in Phase 6. HOSTNAME=0.0.0.0 fixes it; both
networks now return 200.

External network name. ai-internal does not exist - Compose created it as
azureuser_ai-internal under the host's shared project name. Verified both ways
on the host: with name: a container joins and reaches pg-ai, without it up
fails with "network ai-internal declared as external, but could not be found".

Healthcheck. Was probing localhost, which failed for the bind reason above and
marked the container unhealthy while it served fine. Restored to 127.0.0.1,
which now works because the bind is genuinely fixed rather than worked around.

Signup policy. AUTH_DISABLE_SIGNUP false. Langfuse keeps its own user table
behind Authelia; closed signup with no seeded user means nobody can log in at
all. Accepted for the PoC because Authelia is the real gate - revisit before
handover.

Phase 2 gate passed on the host with these applied: 302 to the auth portal,
certificate issued, AD + Duo login confirmed, and a test trace verified in the
database rather than trusted from the API response.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

compose/langfuse-compose.yml

@@ -47,11 +47,23 @@ services:
     environment:
       NEXTAUTH_URL: https://lf.yokogawa.tech
       TELEMETRY_ENABLED: "false"
-      # Authelia already gates this at the edge - no second sign-up flow wanted.
+      # Langfuse is a Next.js standalone server: it binds to whatever $HOSTNAME
-      AUTH_DISABLE_SIGNUP: "true"
+      # resolves to, NOT to all interfaces. This container is on two networks, and
+      # the container hostname resolves to its PROXY address - so without this it
+      # listens on proxy only and is unreachable from ai-internal, where ai-api
+      # will run. Verified on the host: proxy HTTP 200, ai-internal HTTP 000.
+      # Binding 0.0.0.0 makes it listen on both, and on loopback.
+      HOSTNAME: "0.0.0.0"
+      # Langfuse keeps its own user table behind Authelia. Signup is left OPEN so
+      # anyone who has already cleared AD + Duo can create their own account -
+      # with it closed and no user seeded, nobody can log in at all. Accepted
+      # for the PoC because Authelia is the real gate. Revisit before handover.
+      AUTH_DISABLE_SIGNUP: "false"
       # DATABASE_URL, NEXTAUTH_SECRET and SALT come from langfuse.env.
     healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost:3000/api/public/health || exit 1"]
+      # Works because HOSTNAME=0.0.0.0 above makes it bind all interfaces including
+      # loopback. Without that env var this probe fails while the app serves fine.
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3000/api/public/health || exit 1"]
       interval: 30s
       timeout: 5s
       retries: 3
@@ -60,7 +72,13 @@ services:
       options: { max-size: "10m", max-file: "3" }
 
 networks:
+  # Created by ai-compose.yml, which runs under the shared 'azureuser' project,
+  # so Compose named it azureuser_ai-internal. Without the name: line the lookup
+  # is for a network literally called 'ai-internal' and up fails with
+  # "network ai-internal declared as external, but could not be found".
   ai-internal:
     external: true
+    name: azureuser_ai-internal
+  # proxy was created by hand, not by Compose, so it carries no project prefix.
   proxy:
     external: true