feat: add API_KEY and BLOCK_PRIVATE_IPS config vars

docker-compose.yml

@@ -7,5 +7,7 @@ services:
       - ./logs:/srv/logs
     environment:
       - URL=http://localhost:8080
+      # - API_KEY=your-secret-key      # if set, all /api requests must provide it
+      # - BLOCK_PRIVATE_IPS=true       # block LAN/loopback/metadata IPs (recommended for public hosting)
     ports:
       - 8080:80