fix(rpc): keep public node RPC loopback-only

[Lesnak1]

Summary

• Remove --rpc-external from the mainnet and testnet public RPC services so the node RPC stays on loopback and public HTTPS/WSS traffic continues through Caddy.
• Explain the bind behavior and retain the firewall deny rule as defense in depth.
• Add a regression test for both Compose services and run it in lint CI.

Validation

• python -m unittest discover --start-directory tests --verbose — 1 test passed locally.
• git diff --check — clean.

Related to #9 (finding 3).