Reach consumers by network, not by a second host bind

The compose file published a second host port on the docker bridge IP so
sibling containers could reach the relay. That is a host-reachable address for
a service whose entire safety story is that it has exactly one, on loopback.

It joins the consumers' existing docker network instead, and is reached there
by name on the container port. Nothing about a consumer's deployment has to
change to use it, and the relay gains no address outside that network.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

.env.example

@@ -1,9 +1,15 @@
 # Copy to .env on the host and chmod 600. Values come from the estate's
 # existing accounts — this service issues no credentials of its own.
 
-# The port this is published on, from the registry at $SHRE_PORTS_PATH.
+# The port this is published on — 127.0.0.1 only — from the registry at
+# $SHRE_PORTS_PATH. Verify it is free with `ss -ltn` before claiming it.
 CHANNEL_EXIT_PORT=
 
+# The existing docker network the containerised consumers are on. The relay
+# joins it and is reachable there as http://channel-exit:8080 — note the
+# container port, not CHANNEL_EXIT_PORT. Must already exist.
+CHANNEL_EXIT_NETWORK=
+
 # The shared secret every consumer presents as `Authorization: Bearer ...`.
 # Generate with: openssl rand -hex 32
 CHANNEL_EXIT_TOKEN=