Bind local NATS server to 127.0.0.1 instead of all interfaces

Bind local NATS server to 127.0.0.1 instead of all interfaces

nats-server defaults to binding 0.0.0.0, and the systemd unit didn't
override that - meaning any host that can reach munin's port 4222 could
publish/subscribe to the bot's classifier exchange or JetStream streams
with zero authentication configured. It's only ever used by processes on
the same host (nats_uri=localhost), so restrict it to loopback.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>