wolf-pair: don't expose the pairing UI publicly when Caddy fronts it

wolf-pair has no login of its own — Authelia via Caddy is the only
protection option offered for it — but UFW opened its port to the
whole internet unconditionally, before the Caddy/Authelia prompt even
ran. Same gap just fixed for the Asterisk web admin: reachable
straight over the bare port regardless of Authelia.

Reordered so the Caddy decision happens first, and scope the port to
caddy_net's subnet via ufw_allow_from_caddy_net() instead of leaving
it open to 0.0.0.0/0 when Caddy fronts it locally. Also enables UFW
via ensure_ufw_enabled() like the Asterisk services.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015X1jRGHwrvovz2qkhKfDZi

services/wolf-pair.sh

@@ -422,13 +422,11 @@ COMPOSE
 
     chown -R "$ACTUAL_USER:$ACTUAL_USER" "$WOLFPAIR_DIR"
 
-    # ── 4. Firewall ───────────────────────────────────────────────────────────
-    if command -v ufw &>/dev/null; then
-        ufw allow "${WOLFPAIR_PORT}/tcp" comment "wolf-pair pairing UI" >/dev/null 2>&1 || true
-        log_success "UFW: opened port $WOLFPAIR_PORT/tcp"
-    fi
-
-    # ── 5. Caddy (optional) ───────────────────────────────────────────────────
+    # ── 4. Caddy (optional) ───────────────────────────────────────────────────
+    # Decided before the firewall rule below: wolf-pair has no login of its
+    # own (that's the whole reason to offer Authelia here), so if Caddy ends
+    # up fronting it locally, the UFW rule must not also leave the bare port
+    # open to the internet — that would bypass Authelia entirely.
     local WOLFPAIR_EXTRA_BLOCK=""
     if [ -d "$DOCKER_DIR/authelia" ]; then
         local _use_auth=""
@@ -437,6 +435,18 @@ COMPOSE
     fi
     configure_caddy_for_service "wolf-pair" "$WOLFPAIR_PORT" "wolf-pair" "$WOLFPAIR_EXTRA_BLOCK"
 
+    # ── 5. Firewall ───────────────────────────────────────────────────────────
+    if command -v ufw &>/dev/null; then
+        if [[ "$CADDY_SERVICE_CONFIGURED" == true && "$CADDY_SERVICE_MODE" == "local" ]]; then
+            ufw delete allow "${WOLFPAIR_PORT}/tcp" 2>/dev/null || true
+            ufw_allow_from_caddy_net "${WOLFPAIR_PORT}"
+        else
+            ufw allow "${WOLFPAIR_PORT}/tcp" comment "wolf-pair pairing UI" >/dev/null 2>&1 || true
+            log_success "UFW: opened port $WOLFPAIR_PORT/tcp"
+        fi
+        ensure_ufw_enabled
+    fi
+
     # ── 6. README ─────────────────────────────────────────────────────────────
     write_readme "$WOLFPAIR_DIR" << 'MD'
 # wolf-pair