docs: document HOST validation and bind control (E00-S04-T04)

The non-container guide now notes that HOST is validated at the adapter
boundary as a hostname/IP (invalid values fail startup naming the field) and
that the server passes config.host to server.listen, so a configured HOST
binds exactly that interface and the startup log reflects the actual bind.
The config-env-adapter CI job comment is refreshed to describe the extended
suite (HOST validation + loopback-only boot probe).

.gitea/workflows/ci.yml

@@ -233,11 +233,15 @@ jobs:
   # validated config) with a comment-stripped workspace scan, mutation probes
   # (injecting a direct process.env read into any other module fails the scan),
   # a deterministic boundary probe (full env mapping, defaults, bad-PORT
-  # fallback, missing required secret -> MissingRequiredSettingError) and
-  # server-boot probes (a PORT/HOST override shows up in the resolved
-  # configuration; a missing required secret still fails startup). The job
-  # installs the frozen workspace and builds the config and database-postgres
-  # packages because the probes boot the committed server which imports them.
+  # fallback, HOST validated as hostname/IP with invalid values throwing a
+  # field-specific startup error, missing required secret ->
+  # MissingRequiredSettingError) and server-boot probes (a PORT/HOST override
+  # shows up in the resolved configuration; HOST=127.0.0.1 binds loopback only
+  # and the startup log reflects the actual bind; an invalid HOST fails startup
+  # naming the field without echoing the raw value; a missing required secret
+  # still fails startup). The job installs the frozen workspace and builds the
+  # config and database-postgres packages because the probes boot the committed
+  # server which imports them.
   config-env-adapter:
     name: Env adapter owns process.env (E00-S04-T04)
     runs-on: ubuntu-latest