Fix Caddy reverse-proxy target for host-network services

Caddy runs in its own container on the caddy_net bridge network, so
"localhost" in a Caddyfile site block resolves to Caddy's own
container — never the host, and never a sibling container. That
broke every reverse proxy pointed at a network_mode: host service
(confirmed live with asterisk-do's web admin): once nothing else
(like a forward_auth redirect) intercepted the request first, Caddy
couldn't actually reach the upstream.

- services/caddy.sh: add extra_hosts so host.docker.internal resolves
  inside the Caddy container (Linux Docker needs this explicitly —
  it's automatic only on Docker Desktop).
- lib/common.sh's configure_caddy_for_service: bare-port upstreams
  (its documented "host-network service" case) now target
  host.docker.internal instead of localhost.
- services/asterisk-do.sh: its self-contained Caddy block (doesn't go
  through configure_caddy_for_service) gets the same fix for local
  Caddy, and now correctly targets the droplet's public IP instead of
  localhost for the remote-Caddy snippet case, which had the same bug.

services/asterisk.sh needs no direct change — it already goes through
configure_caddy_for_service, so it inherits the fix.

lib/common.sh

@@ -416,12 +416,17 @@ configure_caddy_for_service() {
     local SERVICE_NAME="$1" SERVICE_UPSTREAM="$2" DEFAULT_SUBDOMAIN="$3" EXTRA_CONFIG="${4:-}"
 
     # Derive the proxy upstream and a port number for display messages.
-    # Plain number  → localhost:PORT  (host-network or legacy services)
-    # name:port     → used as-is      (preferred: service on shared caddy_net)
+    # Plain number  → host.docker.internal:PORT  (host-network or legacy
+    #                 services — Caddy itself runs in its own container on
+    #                 caddy_net, a bridge network, so "localhost" here would
+    #                 resolve to Caddy's own container, not the host. Requires
+    #                 the extra_hosts entry set in services/caddy.sh's compose
+    #                 file — see the comment there.)
+    # name:port     → used as-is                  (preferred: service on shared caddy_net)
     local _UPSTREAM _DISPLAY_PORT
     case "$SERVICE_UPSTREAM" in
-        *:*) _UPSTREAM="$SERVICE_UPSTREAM";           _DISPLAY_PORT="${SERVICE_UPSTREAM##*:}" ;;
-        *)   _UPSTREAM="localhost:$SERVICE_UPSTREAM"; _DISPLAY_PORT="$SERVICE_UPSTREAM"      ;;
+        *:*) _UPSTREAM="$SERVICE_UPSTREAM";                       _DISPLAY_PORT="${SERVICE_UPSTREAM##*:}" ;;
+        *)   _UPSTREAM="host.docker.internal:$SERVICE_UPSTREAM";  _DISPLAY_PORT="$SERVICE_UPSTREAM"      ;;
     esac
 
     # ── Determine Caddy mode ──────────────────────────────────────────────────