devops(observability): fix Prometheus port binding, scrape port, and update DEPLOYMENT.md

- Fix spring-boot scrape target from backend:8080 to backend:8081 (actuator/management port)
- Restrict Prometheus host port binding to 127.0.0.1 to prevent unintended external exposure
- Add observability stack (Prometheus, Node Exporter, cAdvisor) to topology description
- Add PORT_PROMETHEUS env var to DEPLOYMENT.md reference table

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infra/observability/prometheus/prometheus.yml

@@ -17,7 +17,7 @@ scrape_configs:
       # Uses the Docker service name (not container_name) for reliable DNS resolution.
       # Target will show as DOWN until backend instrumentation issue adds
       # micrometer-registry-prometheus and exposes the endpoint — this is expected.
-      - targets: ['backend:8080']
+      - targets: ['backend:8081']
 
   - job_name: ocr-service
     metrics_path: /metrics