fix: harden private tracker deployment

[DeepZone]

Summary

• make the telemetry API host binding configurable for a reverse proxy on another private host
• document safe host-side secret permissions for distinct unprivileged container users
• ignore macOS AppleDouble metadata in tracker builds and migration discovery
• execute migration statements individually for broader PostgreSQL protocol compatibility

Verification

• tracker unit tests pass
• deployed on 192.168.58.161 with tracker and PostgreSQL healthy
• public health endpoint returns 200
• public listener rejects dashboard routes with 404
• dashboard requires authentication and valid login returns 200
• PostgreSQL remains unpublished