fix(security): close public metrics exposure

monitoring/docker-compose.yml

@@ -1,7 +1,4 @@
-version: '3.8'
-
 services:
-  # cAdvisor - 容器資源監控
   cadvisor:
     image: gcr.io/cadvisor/cadvisor:latest
     container_name: cadvisor
@@ -24,7 +21,7 @@ services:
     container_name: prometheus
     restart: unless-stopped
     ports:
-      - "9090:9090"
+      - "127.0.0.1:9090:9090"
     volumes:
       - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
       - prometheus_data:/prometheus
@@ -38,16 +35,15 @@ services:
       - monitoring
       - momo-network
 
-  # Grafana - 視覺化儀表板
   grafana:
     image: grafana/grafana:latest
     container_name: grafana
     restart: unless-stopped
     ports:
-      - "3000:3000"
+      - "127.0.0.1:3000:3000"
     environment:
       - GF_SECURITY_ADMIN_USER=admin
-      - GF_SECURITY_ADMIN_PASSWORD=WoooTech2026
+      - "GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:?GRAFANA_ADMIN_PASSWORD is required}"
       - GF_INSTALL_PLUGINS=
       - GF_SERVER_ROOT_URL=http://192.168.0.110:3000
     volumes:
@@ -58,13 +54,12 @@ services:
     depends_on:
       - prometheus
 
-  # Node Exporter - 主機資源監控
   node-exporter:
     image: prom/node-exporter:latest
     container_name: node-exporter
     restart: unless-stopped
     ports:
-      - "9100:9100"
+      - "127.0.0.1:9100:9100"
     command:
       - '--path.procfs=/host/proc'
       - '--path.sysfs=/host/sys'
@@ -77,13 +72,12 @@ services:
     networks:
       - monitoring
 
-  # Blackbox Exporter - 網站/域名監控
   blackbox-exporter:
     image: prom/blackbox-exporter:latest
     container_name: blackbox-exporter
     restart: unless-stopped
     ports:
-      - "9115:9115"
+      - "127.0.0.1:9115:9115"
     volumes:
       - ./blackbox.yml:/etc/blackbox_exporter/config.yml:ro
     command: