Pin frontend to 127.0.0.1:8089 and drop dual-proxy fallback for cp-workers

Single Telegram route via cp-vpn avoids AuthKeyDuplicatedError
(same session key used from two IPs).

docker-compose.yml

@@ -44,7 +44,7 @@ services:
   ca-frontend:
     build: ./centers/analytics/frontend
     ports:
-      - "8080:80"
+      - "127.0.0.1:8089:80"
     depends_on:
       - ca-api
     restart: unless-stopped
@@ -73,10 +73,6 @@ services:
       TELEGRAM_SESSION_PATH: /data/telegram.session
       TELEGRAM_LISTENER_ENABLED: "true"
       TELEGRAM_LISTENER_REFRESH_SECONDS: "60"
-      # Env fallback when VPN tab is off (host Happ/xray; socat 11080→10808).
-      # Overrides .env 127.0.0.1 which is wrong inside the container.
-      TELEGRAM_PROXY_HOST: host.docker.internal
-      TELEGRAM_PROXY_PORT: "11080"
       CP_VPN_HOST: cp-vpn
       CP_VPN_PORT: "1080"
       ENABLED_ADAPTERS: telegram
@@ -84,8 +80,6 @@ services:
       CA_API_URL: http://ca-api:8000
       REDIS_URL: redis://redis:6379/0
       INTERNAL_TOKEN: ${INTERNAL_TOKEN:-dev-internal-token}
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
     volumes:
       - ./data:/data
     depends_on: