SeaweedFS: S3 gateway on the compose network only

PocketBase reaches the gateway over the compose network (or inside the
AIO container), so publishing 8333 on the host only made a second
SeaweedFS stack fail with "port is already allocated". Drop the binding
and SEAWEED_S3_BIND/SEAWEED_S3_PORT.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Docker-AIO/README.md

@@ -131,8 +131,8 @@ copied from the official image, pinned by the `SEAWEED_VERSION` build arg), on
 a `/seaweed/data` volume of its own, with PocketBase's program creating the
 bucket before it serves. One container, two volumes; the cost is that a new
 SeaweedFS is a rebuild rather than a tag change. Inside, the volume server sits
-on **8081** since 8080 is the API Server, and only the gateway is published, on
-loopback by default. The build needs the repo checkout, so either build on the
+on **8081** since 8080 is the API Server, and nothing of SeaweedFS is
+published: PocketBase reaches the gateway inside the container. The build needs the repo checkout, so either build on the
 deploy host or `docker compose push` the image to `AIO_IMAGE` and `pull` it
 there. The external-S3 ones add no containers at all: set `PB_S3_ENDPOINT`, and
 create the bucket yourself.
@@ -155,8 +155,7 @@ programs. One container, three volumes (`PB_DATA`, `SEAWEED_DATA`,
 gateway's program instead of a `seaweedfs-init` container. What survives of
 "split" in there is per-role restart, per-role metrics ports and the admin UI;
 what does not is spreading the roles over hosts. Inside, every role listens on
-loopback, and only the gateway and the admin UI are published, on loopback by
-default.
+loopback, and only the admin UI is published, on loopback by default.
 
 Identities work differently there, and it matters. SeaweedFS reads credentials
 from, in descending priority: an `-s3.config` file, the filer's IAM store, then
@@ -173,7 +172,7 @@ updates that identity in place.
 Set `SEAWEED_ADMIN_PASSWORD`: `weed admin` serves the panel with no
 authentication when it is empty, and a panel that can mint bucket credentials is
 the bucket (the baked-in image refuses to start the panel at all without one).
-In the prod file it is bound to loopback like `SEAWEED_S3_BIND` — it is storage
+In the prod file it is bound to loopback — it is storage
 plumbing, not one of the app's own panels — so a remote host needs
 `SEAWEED_ADMIN_BIND=0.0.0.0` behind a reverse proxy. Neither file publishes
 anything for master, volume and filer: the volume server serves file content by