library: BIND_ADDR for loopback-only mode, real readiness check

- BIND_ADDR (default 0.0.0.0) on every published port; 127.0.0.1 keeps the
  stack reachable from the host only (Docker bypasses ufw, so this is the
  actual control the kiosk addon's 'this kiosk only' choice uses)
- Koha serves its web-installer page with HTTP 200 before the database
  exists, so 'port answers' was not 'ready': the entrypoint now writes
  /run/koha-ready, the healthcheck requires it, and install.sh waits for
  healthy + the quick-add health endpoint

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013wi3ZSot4XbUViwRFgLpRf

library/docker-compose.yml

@@ -38,8 +38,8 @@ services:
       KOHA_ADMIN_PASS: ${ADMIN_PASSWORD}
       KOHA_LIBRARY_NAME: ${LIBRARY_NAME:-My Library}
     ports:
-      - "${OPAC_PORT:-8080}:80"
-      - "${STAFF_PORT:-8081}:8081"
+      - "${BIND_ADDR:-0.0.0.0}:${OPAC_PORT:-8080}:80"
+      - "${BIND_ADDR:-0.0.0.0}:${STAFF_PORT:-8081}:8081"
     volumes:
       - koha-data:/var/lib/koha
 
@@ -63,7 +63,7 @@ services:
       STAFF_PORT: ${STAFF_PORT:-8081}
       QUICKADD_SOURCES: ${QUICKADD_SOURCES:-z3950:lx2.loc.gov:210/LCDB,openlibrary}
     ports:
-      - "${QUICKADD_PORT:-8082}:8082"
+      - "${BIND_ADDR:-0.0.0.0}:${QUICKADD_PORT:-8082}:8082"
     volumes:
       - quickadd-data:/data