feat(docker): expose mysql on host loopback for SSH-tunneled DB access

Binds only to 127.0.0.1 on the Coolify host, not 0.0.0.0, so the DB
is reachable via an SSH tunnel (e.g. SequelAce) but never exposed
publicly.

docker/docker-compose.prod.yml

@@ -33,6 +33,8 @@ services:
       MYSQL_USER: ${DB_USERNAME}
       MYSQL_PASSWORD: ${DB_PASSWORD}
       MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
+    ports:
+      - "127.0.0.1:3306:3306"
     volumes:
       - mysql_data:/var/lib/mysql
     healthcheck: