docs: clarify Hub administrative access and port publishing

[DylanWelzel]

The Studio deployment warning appears late in the tutorial, and the standalone Docker example publishes administrative ports on all host interfaces. Users need the access requirements before starting either environment.

Add a shared Hub deployment and access-control guide and link it from the README, documentation landing page, and Studio, standalone, and Hub tutorials. Explain who should reach each service, distinguish the query API from administrative services, and document network restrictions, gateway coverage, browser access, and verification. Place warnings beside port lists and before startup commands, and bind the standalone example's published ports to 127.0.0.1. Retain the later Studio reminder and its existing #id2 anchor.

This is a documentation change; application authentication and listener defaults are unchanged.

Validation:

• git diff --check passes.
• Full Sphinx HTML builds on the base and this branch produce the same 330 existing diagnostics, with no new diagnostic messages after normalizing paths and line numbers. Strict builds remain nonzero because of those existing issues.
• Checked rendered deployment links, warning placement, service table, and the existing Studio #id2 anchor.
• Checked the rendered Docker command with bash -n and parsed the Compose mapping as YAML. No containers were started.