docker: make SFTP mount reachable through traefik override

Traefik only routes HTTP, so the SFTP port needs its own host publish.
Document 0.0.0.0 bind requirement for WORKSPACE_SFTP_BIND under Docker
and stop the override's ports: !override [] from swallowing it.

compose.yml

@@ -20,6 +20,11 @@ services:
       # Localhost only. Drop this in the override when a reverse proxy
       # reaches the container over its own network instead.
       - "127.0.0.1:4242:4242"
+      # Only listens if WORKSPACE_SFTP_BIND is set in .env (see there);
+      # otherwise this maps to a port nothing is bound on. Traefik is
+      # HTTP-only, so a deployment behind it must publish this port itself
+      # rather than relying on the reverse proxy — see compose.override.yml.example.
+      # - "127.0.0.1:2222:2222"
     healthcheck:
       # No extra tooling in the image, so probe the port with bash directly.
       test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/4242"]