Restrict production wp-admin/wp-login to an IP allowlist (opt-in)

New WP_ADMIN_ALLOWED_IPS env var (space-separated CIDR ranges, matching
Caddy's remote_ip syntax directly). Defaults to 0.0.0.0/0 ::/0 (today's
open behavior) when unset, resolved at the Compose level rather than in
the Caddyfile so an unset var can never leave `remote_ip` with zero
arguments and fail Caddy's startup. admin-ajax.php stays exempt since
WooCommerce routes logged-out storefront AJAX through it. Production
only — staging is already LAN-only.

Verified live: a scratch Caddy instance on a Docker network, with a
sibling container's actual observed source IP used to prove both the
blocked (403 on wp-admin/wp-login, everything else unaffected) and
allowed (matching CIDR lets it through) cases, plus `docker compose
config` to confirm the unset-var default resolves correctly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MqhgnCRjjVLFnZ3Jpn93Vg

README.md

@@ -123,6 +123,19 @@ is blocked on it. Go-live (switching the gateway from sandbox to Helcim's
 live environment) is a deliberate manual step on the settings screen, not
 something this repo automates.
 
+### Admin access restriction (production)
+
+`/wp-admin` and `/wp-login.php` can be restricted to specific IPs/CIDR
+ranges in production via `WP_ADMIN_ALLOWED_IPS` in `.env.production` —
+space-separated, matching Caddy's own `remote_ip` syntax directly (e.g.
+`203.0.113.5 198.51.100.0/24`). Leave it blank and wp-admin stays
+reachable from anywhere, same as today — this is opt-in, not on by
+default, and only applies in production (staging is already LAN-only).
+`/wp-admin/admin-ajax.php` is always exempt regardless of the IP list,
+since WordPress/WooCommerce route some logged-out storefront AJAX
+through it. Applying a changed value just needs `make deploy ENV=production`
+(or restarting the `caddy` container) — no code change required.
+
 ## Deploy pipeline
 
 The Git server (Gitea) and the staging/production Docker hosts are separate