Security: Redact secret names from production logs & bind port to localhost (#1)

* security: redact secret names from logs, bind port to localhost

- handlers: replace secret names in Warn/Error logs with client IP
  (prevents information disclosure via log access/injection)
- client: downgrade secret name logs from Info to Debug level
  (Debug is discarded in production via io.Discard)
- docker-compose: bind port to 127.0.0.1:8080 instead of 0.0.0.0:8080
  (prevents direct access bypassing reverse proxy)

Found during security pen test of vault.turboot.com

* Enhance logging for secret retrieval and cache access

internal/handlers/handlers.go

@@ -40,7 +40,7 @@ func (h *Handler) GetSecret(c *fiber.Ctx) error {
 	}
 
 	if !validators.IsValidSecretName(secretName) {
-		logger.Warn.Printf("Invalid secret name attempted: %s", secretName)
+		logger.Warn.Printf("Invalid secret name format attempted from IP: %s", c.IP())
 		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
 			"error": "invalid secret name format",
 		})
@@ -48,7 +48,7 @@ func (h *Handler) GetSecret(c *fiber.Ctx) error {
 
 	value, err := h.vaultClient.GetSecret(secretName)
 	if err != nil {
-		logger.Error.Printf("Failed to fetch secret '%s': %v", secretName, err)
+		logger.Error.Printf("Failed to fetch secret (requested by IP: %s): %v", c.IP(), err)
 		return c.Status(fiber.StatusNotFound).JSON(fiber.Map{
 			"error": "secret not found",
 		})