Move behind nginx reverse proxy: app binds 127.0.0.1:4567, nginx owns :80

Avoids the cap_net_bind_service dance breaking on every RVM ruby patch
upgrade (it happened today after today's ruby-4.0.7 install).

app.rb

@@ -8,8 +8,10 @@ require_relative 'lib/label_repository'
 
 set :protection, :except => :frame_options
 set :environment, :production
-set :bind, "::"
-set :port, 80
+# nginx reverse-proxies :80 -> here. Loopback-only and an unprivileged port
+# means no more cap_net_bind_service dance on every RVM ruby upgrade.
+set :bind, "127.0.0.1"
+set :port, 4567
 
 if !File.exist?('config.json') || !File.readable?('config.json')
   raise RuntimeException, 'Could not read config.json'