SeaweedFS: S3 gateway on the compose network only

PocketBase reaches the gateway over the compose network (or inside the
AIO container), so publishing 8333 on the host only made a second
SeaweedFS stack fail with "port is already allocated". Drop the binding
and SEAWEED_S3_BIND/SEAWEED_S3_PORT.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Docker-AIO/docker-compose.prod.seaweedfs.split.yml

@@ -32,8 +32,8 @@ name: drivervault-aio
 # mounts here unchanged, and vice versa, with no migration either way.
 #
 # Inside the container every SeaweedFS role listens on loopback except the S3
-# gateway and the admin UI, and those two are published on loopback by default,
-# the way the other SeaweedFS files publish them. The volume server serves file
+# gateway and the admin UI. Only the admin UI is published, on loopback by
+# default; PocketBase reaches the gateway inside. The volume server serves file
 # content by id with no authentication at all, so it is never reachable from
 # outside; the admin UI shows what its port would.
 #
@@ -128,14 +128,10 @@ services:
       - "${WEB_PORT:-8090}:80"    # Web App
       - "${PB_PORT:-8070}:8070"   # PocketBase admin UI / API
       - "${API_PORT:-8080}:8080"  # API Server + panel (root /) + /ocpp/{serial}
-      # The S3 gateway, loopback only: PocketBase reaches it inside the
-      # container, so this is here for `aws s3 ls --endpoint-url
-      # http://127.0.0.1:8333` and nothing else. Set SEAWEED_S3_BIND=0.0.0.0 to
-      # expose it, and mean it.
-      - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333"
-      # The admin UI, loopback for the same reason: storage plumbing, not one
-      # of the app's own panels. On a remote host that means unreachable, so
-      # set SEAWEED_ADMIN_BIND=0.0.0.0 and put it behind a reverse proxy.
+      # The S3 gateway is not published: PocketBase reaches it inside the
+      # container. The admin UI is, on loopback: storage plumbing, not one of
+      # the app's own panels. On a remote host that means unreachable, so set
+      # SEAWEED_ADMIN_BIND=0.0.0.0 and put it behind a reverse proxy.
       - "${SEAWEED_ADMIN_BIND:-127.0.0.1}:${SEAWEED_ADMIN_PORT:-23646}:23646"
     volumes:
       # Named volumes by default; set any of them to a host path in .env for a