[CORE] Housekeeping: CLAUDE.md allineato, docker hardening, gitignore

- CLAUDE.md: aggiunto NonConformityController, companies.html, architecture.html,
  i18n.js, help.js, SQL 003-005, 22 tabelle, endpoint NCR/CAPA, API base path
  aggiornato a /api/... (post-subdomain), cronologia commit aggiornata
- docker-compose.yml: mem_limit (app 256m, web 128m, db 512m) + DB port
  binding su 127.0.0.1 per sicurezza
- .gitignore: aggiunti docker/*.bak* e .claude/memory/
- Eliminati file backup temporanei docker-compose.yml.bak.*

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker/docker-compose.yml

@@ -8,6 +8,7 @@ services:
       dockerfile: docker/Dockerfile
     container_name: nis2-app
     restart: unless-stopped
+    mem_limit: 256m
     volumes:
       - ../application:/var/www/nis2-agile/application
       - ../public:/var/www/nis2-agile/public
@@ -35,6 +36,7 @@ services:
     image: nginx:1.27-alpine
     container_name: nis2-web
     restart: unless-stopped
+    mem_limit: 128m
     ports:
       - "${WEB_PORT:-8080}:8080"
     volumes:
@@ -51,13 +53,14 @@ services:
     image: mysql:8.0
     container_name: nis2-db
     restart: unless-stopped
+    mem_limit: 512m
     environment:
       MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD:-rootpass}
       MYSQL_DATABASE: ${DB_NAME:-nis2_agile_db}
       MYSQL_USER: ${DB_USER:-nis2_user}
       MYSQL_PASSWORD: ${DB_PASS}
     ports:
-      - "${DB_EXPOSE_PORT:-3307}:3306"
+      - "127.0.0.1:${DB_EXPOSE_PORT:-3307}:3306"
     volumes:
       - nis2-db-data:/var/lib/mysql
       - ../docs/sql/001_initial_schema.sql:/docker-entrypoint-initdb.d/001_initial_schema.sql:ro