Constrain local relay and support listeners

[philip-martinez-identityfabric]

What changed

• Add BUZZ_HEALTH_ADDR and BUZZ_METRICS_ADDR full socket-address settings.
• Preserve the existing BUZZ_HEALTH_PORT and BUZZ_METRICS_PORT behavior when the new settings are absent.
• Pass the configured addresses to the health and Prometheus listeners instead of hardcoding all-interface binds.
• Teach the development port-collision checks about the full-address settings.
• Document the settings and add configuration tests for loopback binding, precedence, and invalid addresses.
• Bind the local Docker Compose support services to IPv4 loopback.

Why

The main relay already supported a configurable bind address, but the health and metrics listeners were hardcoded to all IPv4 interfaces. Local development services were also published on every interface. That made a workstation-only Buzz stack broader on the LAN than necessary.

Impact

Existing deployments retain their current defaults. Operators can opt into narrower health and metrics listeners with full socket addresses. The checked-in development Compose stack is now workstation-local by default.

Validation

• cargo fmt --all -- --check
• 25 buzz-relay configuration tests
• cargo clippy -p buzz-relay --all-targets -- -D warnings
• Runtime readback with relay, health, and metrics listening on 127.0.0.1; relay root, liveness, readiness, and metrics returned HTTP 200
• docker compose config --quiet
• Pre-push branch-skew, rust-tests, and desktop-tauri-test hooks

A separate full buzz-relay package run encountered the existing api::mesh_demo::tests::demo_join_forwarded_arm_round_trips_echo 504-versus-200 timeout. The exact test reproduced unchanged on the base commit, so it is not attributed to this patch.