Listen on 0.0.0.0 by default and log LAN addresses

- New CANON_HOST (default 0.0.0.0; 127.0.0.1 keeps it on one machine)
- On start, log the http:// addresses other devices can use, skipping
  Docker/VM bridge interfaces
- docker-compose publishes 0.0.0.0:4242 explicitly
- README: opening Canon from other devices and firewall note

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -30,6 +30,10 @@ Open `http://localhost:4242/setup`, enter the setup code and create your account
 
 To skip the setup page, set `CANON_ADMIN_USERNAME` and `CANON_ADMIN_PASSWORD` in `.env` before the first start. They're only used when no account exists yet.
 
+### Opening it from other devices
+
+Canon listens on all network interfaces (`0.0.0.0`) by default, so phones and other computers on your network can open `http://<this computer's IP>:4242`. When run outside Docker, the startup log prints the exact addresses. If another device can't connect, the host's firewall is probably blocking the port (for example `sudo ufw allow 4242/tcp`). To keep Canon private to one machine, set `CANON_HOST=127.0.0.1`, or publish `127.0.0.1:4242:4242` in `docker-compose.yml`.
+
 ### Without Compose
 
 ```sh
@@ -60,6 +64,7 @@ Keys entered in the UI are stored in the SQLite database on your server. Keys se
 
 | Variable | Default | |
 |---|---|---|
+| `CANON_HOST` | `0.0.0.0` | Interface to listen on. `0.0.0.0` makes it reachable from other devices on your network; `127.0.0.1` keeps it on this machine |
 | `CANON_PORT` | `4242` | Listen port |
 | `CANON_DATA_DIR` | `/data` (Docker), `./data` | Database + cached images |
 | `CANON_ADMIN_USERNAME` / `_PASSWORD` | | Create the owner account on first start |