Expose staging port to reverse proxy

deploy/compose.staging.yml

@@ -16,7 +16,7 @@ services:
       TDR_AVATAR_STORAGE_PATH: /app/data/avatars
       TDR_GAME_ICON_STORAGE_PATH: /app/data/game-icons
     ports:
-      - "127.0.0.1:${SHD_STAGE_PORT:-5569}:3000"
+      - "0.0.0.0:${SHD_STAGE_PORT:-5569}:3000"
     volumes:
       - shd_stage_data:/app/data
     healthcheck:

docs/DEPLOYMENT.md

@@ -25,7 +25,7 @@ database.
 Staging defaults to:
 
 - Public origin: `https://stage.shd.build`
-- Reverse-proxy upstream: `http://127.0.0.1:5569`
+- Reverse-proxy upstream: host port `5569`
 - Database: `/app/data/shd-build-staging.db`
 - Passkey relying-party ID: `shd.build`
 - Adapter canonical origin: `https://stage.shd.build`
@@ -41,7 +41,10 @@ npm run env:encrypt:staging
 Add `https://stage.shd.build/auth/discord/callback` to the Discord application's
 allowed OAuth redirect URIs. Point the staging DNS record at the deployment
 host and configure the host's TLS reverse proxy to forward
-`stage.shd.build` to `127.0.0.1:5569`.
+`stage.shd.build` to port `5569` on the staging host. Docker publishes this
+port on the host interfaces so a containerized reverse proxy or tunnel can
+reach it; firewall the port to trusted LAN/tunnel sources when the host is
+reachable from other networks.
 
 The deployment decrypts `.env.staging` on the trusted staging runner into a
 mode-`0600` runtime file. The decryption key is held by Gitea Actions, not