Apply the local/remote Caddy mode resolution to every service, not just traccar

traccar.sh's caddy_net wiring was fixed to mirror configure_caddy_for_service's
own mode resolution (CADDY_MODE from site config, then a local ~/docker/caddy,
then the legacy CADDY_REMOTE_HOST var) instead of only checking for the local
directory. That same bare directory check was copy-pasted into the caddy_net
wiring of every other Docker service in the repo, so a site with Caddy on a
different box would silently fail to join any of their containers to caddy_net
during setup (or, for homeassistant/koha, only get half the wiring right).

Applied the same fix mechanically across all 37 services using the standard
_CADDY_NET_BLOCK/_CADDY_NET_SECTION pattern (verified identical text via
scripted diff before touching any of them), plus by hand for:
- homeassistant.sh and koha.sh, which use their own differently-shaped
  variables (HA_CADDY_NET_LINES / _CADDY_NET_ENTRY) for the same decision
- paintplus.sh and ai-stack.sh, which do a live `docker network connect`
  instead of a compose network block
- watchyourlan.sh, whose Caddy note was worded for local-only setups

sms-inbound.sh got more than a mode swap: its Caddy wiring was hand-rolled
(not routed through configure_caddy_for_service) and had no remote-Caddy
path at all — a remote Caddy box would get a misleading "Caddy isn't
installed here" message instead of a snippet. Added
_sms_write_caddy_snippet(), mirroring the snippet-file pattern
configure_caddy_for_service uses everywhere else, and pointed the firewall
gate at the same three-way mode instead of a two-way dir check.

Verified: bash -n across all of services/*.sh, a scripted check that every
touched file has exactly one _CADDY_MODE resolution and no leftover bare
`[ -d "$DOCKER_DIR/caddy" ]` feeding a caddy_net decision, and spot-checked
docker compose config renders (traccar, mattermost) confirming the ${VAR}
interpolation and multi-service usage sites still resolve correctly.

services/watchyourlan.sh

@@ -161,9 +161,13 @@ WYL_ENV
     log_success "WatchYourLAN configured at $WYL_DIR"
 
     # WatchYourLAN uses network_mode: host, so Caddy container-name routing
-    # can't reach it via caddy_net. Access is directly on host port $GUI_PORT.
-    # If behind Caddy on the same host, configure manually with host IP:PORT.
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    # can't reach it via caddy_net regardless of where Caddy runs. Access is
+    # directly on host port $GUI_PORT. Mirrors configure_caddy_for_service's
+    # own mode resolution (lib/common.sh) purely to word this note correctly.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+    if [ "$_CADDY_MODE" != "none" ]; then
         echo ""
         log_info "Note: WatchYourLAN uses host networking (needed for ARP scanning)."
         log_info "It cannot join caddy_net. To put it behind Caddy, add this block manually:"
@@ -172,7 +176,11 @@ WYL_ENV
         echo "      reverse_proxy <HOST_IP>:$GUI_PORT"
         echo "  }"
         echo ""
-        echo "  where HOST_IP is this server's IP on the Docker bridge (usually 172.17.0.1)."
+        if [ "$_CADDY_MODE" = "remote" ]; then
+            echo "  where HOST_IP is this server's real network IP (Caddy is on a different box)."
+        else
+            echo "  where HOST_IP is this server's IP on the Docker bridge (usually 172.17.0.1)."
+        fi
     fi
 
     write_readme "$WYL_DIR" << MD