ops: whitelist ALLOW_LOCAL_AI_PRIVATE_HOSTS in the bundled compose

The local AI provider's private-host opt-in is read from the environment but
was missing from the compose environment whitelist, so the value never reached
the container. Add it (and document it in the env example) so a self-hoster can
point the local provider at an internal Ollama / LM Studio host.

.env.production.example

@@ -162,6 +162,12 @@ API_TOKEN_HMAC_KEY="<openssl rand -hex 32>"
 # docs/ops/tls-cert-pin.md for extraction + the re-pin runbook.
 # TLS_LEAF_SPKI_PINS=""
 
+# Local-AI SSRF opt-in (optional). The local AI provider rejects private/
+# internal hosts by default. Set to an exact host allowlist (comma-separated,
+# e.g. "ollama.lan,10.0.0.5") or "true" for any private host — intended for a
+# self-hosted Ollama / LM Studio endpoint. See docs/integrations/ai-providers.md.
+# ALLOW_LOCAL_AI_PRIVATE_HOSTS=""
+
 
 # -----------------------------------------------------------------------------
 # Off-host backups -- all-or-none

docker-compose.yml

@@ -146,6 +146,13 @@ services:
       # container (the `environment:` block is a whitelist). See
       # docs/ops/tls-cert-pin.md.
       TLS_LEAF_SPKI_PINS: "${TLS_LEAF_SPKI_PINS:-}"
+      # Local-AI SSRF opt-in (optional). The local AI provider rejects
+      # private/internal hosts by default; set this to an exact host allowlist
+      # (e.g. "ollama.lan,10.0.0.5") or "true" for any private host, intended
+      # for a self-hosted Ollama / LM Studio. Listed here so an operator value
+      # in .env reaches the container (the `environment:` block is a whitelist).
+      # See docs/integrations/ai-providers.md.
+      ALLOW_LOCAL_AI_PRIVATE_HOSTS: "${ALLOW_LOCAL_AI_PRIVATE_HOSTS:-}"
       # v1.17.1 — SMTP transport for the email notification channel (optional,
       # all-or-none: HOST + PORT + FROM enable it; USER/PASS optional; SECURE
       # toggles implicit TLS). Listed here so operator values in .env reach the