fix(security): remove MySQL and Redis port exposure to host

[chriscrosstalk]

Summary

• Removes ports: mappings for MySQL (3306) and Redis (6379) from the compose template
• Both services are only accessed by the admin container via Docker's internal network (service names mysql and redis)
• Redis has no authentication, so LAN exposure was unnecessary risk

Closes #279

Test plan

• Fresh install: verify admin container connects to MySQL and Redis normally
• Verify MySQL and Redis ports are no longer accessible from the host network
• Verify all NOMAD features work (downloads, benchmarks, AI chat)

🤖 Generated with Claude Code