Fix Caddy reverse-proxy target for host-network services

Caddy runs in its own container on the caddy_net bridge network, so
"localhost" in a Caddyfile site block resolves to Caddy's own
container — never the host, and never a sibling container. That
broke every reverse proxy pointed at a network_mode: host service
(confirmed live with asterisk-do's web admin): once nothing else
(like a forward_auth redirect) intercepted the request first, Caddy
couldn't actually reach the upstream.

- services/caddy.sh: add extra_hosts so host.docker.internal resolves
  inside the Caddy container (Linux Docker needs this explicitly —
  it's automatic only on Docker Desktop).
- lib/common.sh's configure_caddy_for_service: bare-port upstreams
  (its documented "host-network service" case) now target
  host.docker.internal instead of localhost.
- services/asterisk-do.sh: its self-contained Caddy block (doesn't go
  through configure_caddy_for_service) gets the same fix for local
  Caddy, and now correctly targets the droplet's public IP instead of
  localhost for the remote-Caddy snippet case, which had the same bug.

services/asterisk.sh needs no direct change — it already goes through
configure_caddy_for_service, so it inherits the fix.

services/asterisk-do.sh

@@ -769,12 +769,21 @@ ENV
             local _CADDY_MODE="local"
             [[ ! -d "$DOCKER_DIR/caddy" ]] && [[ -n "${CADDY_REMOTE_HOST:-}" ]] && _CADDY_MODE="remote"
 
+            # Asterisk runs with network_mode: host, so whatever proxies to it
+            # needs a way to reach the host, not "localhost" (which resolves
+            # to the proxying container's own netns). A local Caddy container
+            # reaches the host via host.docker.internal (wired up in
+            # services/caddy.sh's compose file); a remote Caddy machine needs
+            # this droplet's actual public IP instead.
+            local _PROXY_TARGET="host.docker.internal:${WEB_ADMIN_PORT_VAL}"
+            [[ "$_CADDY_MODE" == "remote" ]] && _PROXY_TARGET="${PUBLIC_IP}:${WEB_ADMIN_PORT_VAL}"
+
             local _SITE_BLOCK
             _SITE_BLOCK="$(cat << CADDY_BLOCK
 
 # Asterisk Web Admin
 ${DOMAIN_NAME} {
-    reverse_proxy localhost:${WEB_ADMIN_PORT_VAL}
+    reverse_proxy ${_PROXY_TARGET}
 
     header {
         Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"