docs(debug): explain container profiling access

[vsolano9]

Addresses item 4 of #64 only. The other items remain separate.

Change

• Explain why publishing a port does not reach a listener bound to container loopback on a bridge network.
• Lead with a loopback-only docker exec collection example using Python 3, which is already in the runtime image.
• Document the explicit bind/allow_public combination for host-local publishing, same-network peer exposure, Docker's pre-28 localhost-publishing caveat, and Linux host-network mode.

Only docs/configuration.md changes. No runtime or workflow changes.

Validation

Local macOS validation:

• gofmt -l .: empty output.
• go build ./... and go vet ./...: passed.
• go test -race ./...: passed across all 15 packages with tests; the TURN package has no test files.
• Both shell examples passed bash -n; both TOML examples and the embedded Python parsed successfully; relative links resolve.
• The documented Python client collected a real heap profile from an isolated local Go pprof endpoint, and go tool pprof -top read the resulting file successfully.
• git diff --check: passed.

Not run: an end-to-end Docker networking test, because the local Docker daemon is not running. The Python/Go round trip is not a substitute for that test. Database-backed integration was not configured (STREAMCORE_TEST_PG unset). The networking guidance was checked against the Docker documentation linked in the new section.