docs(self-host): document the outbound destination policy and add networking checks

[MasterPtato]

• Document the outbound destination policy in the control plane configuration reference: what it gates, the default deny posture, and how to open specific CIDRs or hosts for workers on a private network.
• Add an outbound hardening item to the production checklist's security section.
• Add a networking section covering L7 load balancer WebSocket timeouts, which silently drop long-lived worker connections at their default 30 to 60 seconds.
• Add FoundationDB disk guidance to the existing enterprise section.

This content was written against the old in-repo website tree and was left behind when public docs moved out. It documents shipped behavior.

[railway-app]

🚅 Deployed to the website-pr-51 environment in rivet-website

Service	Status	Web	Updated
website	😴 Sleeping (View Logs)	Web	Sep 3, 2026 at 10:17 pm UTC