Works on the server, refused from outside

Reproduce the classic failure — an API that answers on the loopback and refuses everyone else — prove the bind with ss, fix it in the service's environment, and catch the inverse mistake: a database published on every address.