WAN-99: add self-host exposure preflight

[haoxianhan]

Summary

• Add a scripts/selfhost-preflight.sh guard for non-loopback/public self-host exposure.
• Wire the guard into make selfhost, make selfhost-build, and the Unix installer before Docker pull/up/build.
• Add BIND_HOST support to Compose while preserving loopback as the default, plus RATE_LIMIT_TRUSTED_PROXIES in backend env.
• Update self-host quickstart, advanced, and troubleshooting docs in all published locales with localhost/LAN/public guidance, /ws Upgrade/TLS/origin/trusted-proxy requirements, secret-safe diagnostics, and Docker volume sensitivity notes.

Verification

• bash -n scripts/selfhost-preflight.sh scripts/selfhost-preflight.test.sh scripts/selfhost-config.test.sh scripts/install.sh scripts/install.test.sh
• bash scripts/selfhost-preflight.test.sh
• bash scripts/selfhost-config.test.sh
• bash scripts/install.test.sh
• git diff --check

Not run

• pnpm --filter @multica/docs test could not run in the clean clone because node_modules is absent and vitest is not installed locally.

[vercel]

@haoxianhan is attempting to deploy a commit to the IndexLabs Team on Vercel.

A member of the Team first needs to authorize it.