Tightening a dev VM that was quietly living without a firewall

What a routine security audit found on a small always-on dev VM — unauthenticated databases, no host firewall, over-privileged automation — and the fixes that made it boring again.