fix(config): apply env overrides at runtime and fix Docker compose defaults (#279)

- Call apply_env_overrides() after Config::load_or_init() in main.rs so
  environment variables (API_KEY, PROVIDER, ZEROCLAW_GATEWAY_PORT, etc.)
  are actually applied at runtime, not just in tests
- Add ZEROCLAW_ALLOW_PUBLIC_BIND env var support for gateway bind policy
- Fix docker-compose.yml: correct volume path (/zeroclaw-data not /data),
  add ZEROCLAW_ALLOW_PUBLIC_BIND=true for container networking, make host
  port configurable via HOST_PORT env var
- Add docker-compose.override.yml to .gitignore for local dev overrides

.gitignore

@@ -3,3 +3,4 @@
 *.db-journal
 .DS_Store
 .wt-pr37/
+docker-compose.override.yml

docker-compose.yml

@@ -25,16 +25,19 @@ services:
       # Options: openrouter, openai, anthropic, ollama
       - PROVIDER=${PROVIDER:-openrouter}
       
+      # Allow public bind inside Docker (required for container networking)
+      - ZEROCLAW_ALLOW_PUBLIC_BIND=true
+      
       # Optional: Model override
       # - ZEROCLAW_MODEL=anthropic/claude-sonnet-4-20250514
       
     volumes:
-      # Persist workspace and config
-      - zeroclaw-data:/data
+      # Persist workspace and config (must match WORKDIR/HOME in Dockerfile)
+      - zeroclaw-data:/zeroclaw-data
       
     ports:
-      # Gateway API port
-      - "3000:3000"
+      # Gateway API port (override HOST_PORT if 3000 is taken)
+      - "${HOST_PORT:-3000}:3000"
     
     # Health check
     healthcheck:

src/config/schema.rs

@@ -1002,6 +1002,11 @@ impl Config {
             }
         }
 
+        // Allow public bind: ZEROCLAW_ALLOW_PUBLIC_BIND
+        if let Ok(val) = std::env::var("ZEROCLAW_ALLOW_PUBLIC_BIND") {
+            self.gateway.allow_public_bind = val == "1" || val.eq_ignore_ascii_case("true");
+        }
+
         // Temperature: ZEROCLAW_TEMPERATURE
         if let Ok(temp_str) = std::env::var("ZEROCLAW_TEMPERATURE") {
             if let Ok(temp) = temp_str.parse::<f64>() {

src/main.rs

@@ -327,7 +327,8 @@ async fn main() -> Result<()> {
     }
 
     // All other commands need config loaded first
-    let config = Config::load_or_init()?;
+    let mut config = Config::load_or_init()?;
+    config.apply_env_overrides();
 
     match cli.command {
         Commands::Onboard { .. } => unreachable!(),