fix: WinBox tunnel bind address, port range, and proxy support

- Bind tunnel listeners to 0.0.0.0 instead of 127.0.0.1 so tunnels
  are reachable through reverse proxies and container networks
- Reduce port range to 49000-49004 (5 concurrent tunnels)
- Derive WinBox URI host from request Host header instead of
  hardcoding 127.0.0.1, enabling use behind reverse proxies
- Add README security warning about default encryption keys

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

poller/internal/tunnel/portpool_test.go

@@ -71,7 +71,7 @@ func TestPortPool_ConcurrentAccess(t *testing.T) {
 
 func TestPortPool_BindVerification(t *testing.T) {
 	// Occupy a port, then verify Allocate skips it
-	ln, err := net.Listen("tcp", "127.0.0.1:49050")
+	ln, err := net.Listen("tcp", "0.0.0.0:49050")
 	require.NoError(t, err)
 	defer ln.Close()