Fix Caddy routing: use container:port via caddy_net (DoTheEvo pattern)

Undo the host.docker.internal approach from the previous commit — proper
Docker networking routes Caddy to services by container name on the shared
caddy_net, not via the host gateway.

- lib/common.sh: configure_caddy_for_service now accepts either a plain
  port number (localhost:PORT fallback) or container:port (preferred).
  The Caddyfile entry uses the container name for direct Docker DNS routing.
- services/caddy.sh: remove extra_hosts hack; update Caddyfile template
  comments to show container_name:port format
- All service files: update configure_caddy_for_service calls to pass
  container_name:internal_port (e.g. "filebrowser:80", "mealie:9000").
  Services using network_mode:host keep plain port numbers.
- tools/manage_users.sh: new FileBrowser user-management script (deployed
  to ~/docker/filebrowser/ during installation). Manages users via the
  FileBrowser REST API: list, add, delete, passwd, scope, info commands.
  Documents username format (letters/numbers/hyphens/underscores),
  password rules (min 8 chars, letter + number required), and scope path
  convention relative to /srv (= FB_PATH on the host).

https://claude.ai/code/session_01UZus2Q9gNTfUdqSMrhuX29

services/frigate-audio.sh

@@ -514,7 +514,7 @@ FNEOF
     # ── Caddy snippet ──────────────────────────────────────────────────────────
     if [ -n "$FRIGATE_PUBLIC_URL" ] && [ "$FRIGATE_PUBLIC_URL" != "https://cam.yourdomain.com" ]; then
         local _DOM="${FRIGATE_PUBLIC_URL#https://}"
-        configure_caddy_for_service "Frigate" "8971" "frigate-audio" || true
+        configure_caddy_for_service "Frigate" "frigate-audio:8971" "frigate-audio" || true
     fi
 
     ensure_docker_dir_ownership "$DIR"