netdata: alert on sustained high CPU via Telegram, restrict LAN exposure

Two cryptominer incursions (inbox-zero, then gitea) went unnoticed until
found manually — there was no alerting on sustained host CPU. Wired
netdata's existing 10min_cpu_usage alarm to notify via the shared Telegram
bot (config is host-only, not committed). Also narrowed the dashboard port
from 0.0.0.0 to the host's LAN IP to reduce exposure.

netdata/docker-compose.yaml

@@ -7,7 +7,11 @@ services:
     restart: unless-stopped
     hostname: ${HOSTNAME:-docker-host}
     ports:
-      - 19999:19999
+      # Bound to the host's LAN IP (not 0.0.0.0) so the dashboard stays
+      # reachable from the LAN but isn't listening on every interface.
+      # NOTE: this host's LAN IP is DHCP-assigned — if it changes, update
+      # this binding to match.
+      - 192.168.1.67:19999:19999
     cap_add:
       - SYS_PTRACE
       - SYS_ADMIN