Bind staging nginx to localhost for Windows Docker Desktop

Publish port 8088 on 127.0.0.1 only so netsh portproxy can expose staging
to LAN/public IPs; document the one-time portproxy setup on Windows.

Co-authored-by: Cursor <cursoragent@cursor.com>

infrastructure/docker-compose.registry.yml

@@ -91,7 +91,8 @@ services:
       frontend:
         condition: service_healthy
     ports:
-      - "${STAGING_HTTP_PORT:-8088}:80"
+      # Localhost only — Docker Desktop on Windows often breaks 0.0.0.0; use netsh portproxy for LAN/public (see STAGING-DEPLOY.md).
+      - "127.0.0.1:${STAGING_HTTP_PORT:-8088}:80"
     volumes:
       - ./nginx/http-only.conf:/etc/nginx/conf.d/default.conf:ro
       - ./logs/nginx-staging:/var/log/nginx