Fix Caddy routing: use container:port via caddy_net (DoTheEvo pattern)

Undo the host.docker.internal approach from the previous commit — proper
Docker networking routes Caddy to services by container name on the shared
caddy_net, not via the host gateway.

- lib/common.sh: configure_caddy_for_service now accepts either a plain
  port number (localhost:PORT fallback) or container:port (preferred).
  The Caddyfile entry uses the container name for direct Docker DNS routing.
- services/caddy.sh: remove extra_hosts hack; update Caddyfile template
  comments to show container_name:port format
- All service files: update configure_caddy_for_service calls to pass
  container_name:internal_port (e.g. "filebrowser:80", "mealie:9000").
  Services using network_mode:host keep plain port numbers.
- tools/manage_users.sh: new FileBrowser user-management script (deployed
  to ~/docker/filebrowser/ during installation). Manages users via the
  FileBrowser REST API: list, add, delete, passwd, scope, info commands.
  Documents username format (letters/numbers/hyphens/underscores),
  password rules (min 8 chars, letter + number required), and scope path
  convention relative to /srv (= FB_PATH on the host).

https://claude.ai/code/session_01UZus2Q9gNTfUdqSMrhuX29

services/caddy.sh

@@ -82,8 +82,6 @@ services:
       - ACME_AGREE=true
     labels:
       - "io.podman.annotations.label/crowdsec.enable=true"
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
     networks:
       - caddy_net
 
@@ -123,7 +121,7 @@ CADDY_COMPOSE
 # Example:
 # myservice.yourdomain.com {
 #     import authelia
-#     reverse_proxy host.docker.internal:PORT
+#     reverse_proxy container_name:port
 # }
 
 # ActualBudget
@@ -133,7 +131,7 @@ CADDY_COMPOSE
 #         format json
 #         level INFO
 #     }
-#     reverse_proxy host.docker.internal:5006
+#     reverse_proxy actualbudget:5006
 #     header {
 #         Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
 #         X-Frame-Options "SAMEORIGIN"
@@ -174,7 +172,7 @@ a web service). You can also edit it by hand:
 
 ```
 myservice.example.com {
-    reverse_proxy host.docker.internal:1234
+    reverse_proxy container_name:1234
     log {
         output file /var/log/caddy/myservice.example.com.log
         format json