feat(vpn): expose Athena services directly over WireGuard

platform/mcp/compose.yaml

@@ -141,9 +141,9 @@ services:
       MCP_TRANSPORT: http
       MCP_HTTP_EXPOSE: "true"
       MCP_HTTP_PORT: "3000"
-      # The endpoint is not published on the host. Host filtering still makes
-      # accidental access from any other Docker name fail closed.
-      MCP_HTTP_ALLOWED_HOSTS: "mike-ai-mcp-navidrome:3000,mike-ai-mcp-navidrome"
+      # OpenWebUI uses the Docker name; Pi/Hermes may reach the same endpoint
+      # directly through Athena's WireGuard address and VPN port 8207.
+      MCP_HTTP_ALLOWED_HOSTS: "mike-ai-mcp-navidrome:3000,mike-ai-mcp-navidrome,${VPN_SERVICE_IP:-192.168.1.212}:8207,${VPN_SERVICE_IP:-192.168.1.212}"
       WEBUI_ENABLED: "false"
     tmpfs:
       - /tmp:rw,noexec,nosuid,nodev,size=64m