[TASK] Harden LLM service by restricting it to internal Docker network

[MikeNovikoff]

Description

The llm-service does not implement authentication. To prevent unauthorized direct access, it must be reachable only from within the Docker Compose network. The quiz_core service will act as the sole gateway

To do

docker-compose.yml: Ensure quiz_core depends on llm-service healthcheck
quiz_core config: Use internal DNS name http://llm-service:7000 

Notes

Acceptance Criteria

• llm-service has no exposed ports on the host
• Only quiz_core (and other services in the same Compose network) can resolve llm-service:7000
• Healthcheck in Compose still passes internally
• Frontend/mobile clients must go through quiz_core (/core/quizzes/generate)