Pin images, rotate logs, cap Jaeger and bind dev ports to loopback

- Pin seaweedfs (4.47), jaeger (1.76.0), certbot (v5.8.0) and pgadmin
  (9.18) instead of :latest.
- Rotate container logs (json-file, 3 x 10 MB) in every stack.
- Cap Jaeger's in-memory storage at 100k traces and add a healthcheck.
- Publish dev ports on 127.0.0.1 (DEV_BIND_ADDRESS) so the dev
  credentials aren't reachable from the LAN.
- Fix the prod command in compose.yml's header, the README's note on who
  writes the admin PAT, and the certbot command's line breaks.

.env.example

@@ -3,6 +3,11 @@
 #
 #   cp .env.example .env
 
+# Address the dev ports are published on. 127.0.0.1 keeps them off the LAN.
+# Use 0.0.0.0 only if your hosts file maps host.docker.internal to the LAN IP
+# (then the browser can't reach 127.0.0.1-only ports through that name).
+DEV_BIND_ADDRESS=127.0.0.1
+
 # --- PostgreSQL (shared instance, one database per project) -----------------
 POSTGRES_USER=postgres
 POSTGRES_PASSWORD=postgres