Expose SSO (3001) + proxy mgmt (3000) UIs on the LAN by default

The SSO web UI and the proxy management UI were bound to 127.0.0.1, so they
were only reachable from the host running the stack — inconvenient during
first-run setup from another machine. Make the bind address configurable
(SSO_BIND / MGMT_BIND, default 0.0.0.0) so both are LAN-reachable by default,
with a one-line flip back to 127.0.0.1 once the proxy fronts them under TLS.

Also: friendlier README with an upfront prerequisites section (domain, >=2 DNS
records to the public IP, port-forward 80/443) and a note that .env values with
spaces should be quoted.

Co-Authored-By: Claude <noreply@anthropic.com>

.env.example

@@ -52,8 +52,7 @@ SMTP_PASS=
 SMTP_FROM=
 
 # ── Optional: host port overrides ───────────────────────────────────────────
-# SSO web UI (mapped to host for first-run convenience; the proxy fronts it in
-# normal use, so you can leave it unmapped by setting SSO_PORT=0).
+# SSO web UI + proxy mgmt UI host ports.
 SSO_PORT=3001
 LDAPS_PORT=636
 # Proxy listeners:
@@ -62,6 +61,14 @@ HTTPS_PORT=443
 HTTPS_ALT_PORT=4443
 MGMT_PORT=3000
 
+# ── Optional: bind address for the SSO UI (3001) + proxy mgmt UI (3000) ───────
+# Default 0.0.0.0 = reachable on the LAN (convenient for first-run / admin from
+# another machine). These UIs are login-protected, but exposing them widens the
+# attack surface; once the proxy fronts both under TLS you can lock them to the
+# host only by setting each to 127.0.0.1.
+SSO_BIND=0.0.0.0
+MGMT_BIND=0.0.0.0
+
 # ── Optional: LDAP TLS cert CN (hostname LDAPS clients verify) ───────────────
 # Defaults to LDAP_DOMAIN. Set to the hostname the proxy connects via
 # (sso-manager inside the docker net uses the service name, which is in the