docker: make SFTP mount reachable through traefik override

Traefik only routes HTTP, so the SFTP port needs its own host publish.
Document 0.0.0.0 bind requirement for WORKSPACE_SFTP_BIND under Docker
and stop the override's ports: !override [] from swallowing it.

.env.example

@@ -24,6 +24,16 @@ WORKSPACE_MAX_UPLOAD_MB=64
 # Set to 1 once the app is served over HTTPS, so the cookie gets `Secure`.
 WORKSPACE_SECURE_COOKIE=0
 
+# --- SFTP mount --------------------------------------------------------------
+# Off until this is set. Once it's up, register a key with `:sshkey add <name>
+# <ssh-ed25519 ...>` in the app, then `sshfs -P <port> anything@host:/ mnt/`
+# (the username is ignored — only the key decides who gets in).
+#
+# Under Docker, bind 0.0.0.0 (not 127.0.0.1) as the app listens inside the
+# container — the host-side address in compose.yml's `ports:` is what
+# actually restricts who can reach it.
+# WORKSPACE_SFTP_BIND=127.0.0.1:2222
+
 # --- Proton Drive backup -----------------------------------------------------
 # Off until `narl-workspace proton-login` stores a session under WORKSPACE_DATA_DIR.
 # These only shape how often the mirror runs.