network_mode: host removes every isolation boundary Docker would provide

Applied to all five services, with the bridge network commented out at `docker-compose.yml:105-107,236-239`.

What it removes:
- Per-service network namespaces — any container-local process reaches every other service on loopback, and `127.0.0.1` inside a container **is** the host.
- Docker's published-port firewall — `expose:` becomes decorative; nothing is filtered.
- The ability to bind a service to a private Docker network address.
- DNS-based service isolation.

This single decision is what turns the memcached RCE, the Gunicorn bind, and the Postgres/RabbitMQ exposure from container-internal problems into **LAN-wide** ones.

**Fix:** uncomment the bridge network and publish only what nginx needs. If host networking must stay for performance, then every service's bind address must be `127.0.0.1` explicitly.

---

**Evidence**

```
docker-compose.yml:28,105-107,108,136,162,200,236-239
```

- Verified against: `origin/master 44ca47e (2026-07-25)`
- Verdict: **CONFIRMED**

Start in docker-compose.yml at lines 28, 105-108, 136, 162, 200, and 236-239. Inspect the five services' host-network settings, the commented bridge network, and published or exposed ports. Done means the bridge network is restored with only nginx published, or every host-networked service explicitly binds to 127.0.0.1.

Written by the indexing model from the issue text.