fix(settings): ALLOWED_HOSTS lists the server's names instead of accepting any host

docker-compose.yml

@@ -14,6 +14,9 @@ services:
       # - SECRET_KEY=your-custom-secret-key-here
       # Optional: comma-separated trusted CSRF origins (e.g. http://wvc.example.com,https://wvc.example.com)
       # - CSRF_TRUSTED_ORIGINS=http://localhost,http://127.0.0.1
+      # Host names/IPs the panel is reached by (comma-separated; "*" accepts any).
+      # Without it only localhost works. Set it in docker-compose.override.yml.
+      - ALLOWED_HOSTS=localhost
       - TZ=UTC
     volumes:
       # Persistent SQLite database and runtime data