Add Host security guidance starting with what port 8080 exposes.

[johnnymatthews]

The team spotted a Host at http://168.119.73.186:8080/metrics and had to ask in Discord whether anyone recognized the IP. The owner confirmed it was theirs. The metrics endpoint was sitting on the open internet, and nothing in the docs warns the operator that this will happen.

The structural part: the register page tells Hosts to open inbound 8080 so the dashboard can probe /health, and 8080 also serves /metrics. So a Host following the docs puts its metrics on the internet. The quickstart and the prod VM example both route /metrics through nginx on the public 8080 listener with nothing restricting access beyond CORS, and the quickstart verifies the setup by fetching http://<VM_IP>:8080/metrics from outside. The Generator docs at least have a security page that walks through which paths are safe to expose and how to put an allowlist in front. The Host docs have no equivalent, and the monitoring page is still a stub.

• Add Host port exposure guidance: what each port serves, what has to be reachable (the dashboard probe on 8080, and 9181 for serving queries), and what to do about /metrics.
• Show an nginx pattern that keeps /health probeable while restricting /metrics, or confirm with the client team whether the probe can be scoped so only /health needs to be public.
• Decide where it lives: a new Host security page, or an extension of Create Security Q/A page #315 (the open Security Q/A page, which covers the threat model).

It might be an idea to spin up a Security page for the hosts too.