Fix Caddy routing: use container:port via caddy_net (DoTheEvo pattern)

Undo the host.docker.internal approach from the previous commit — proper
Docker networking routes Caddy to services by container name on the shared
caddy_net, not via the host gateway.

- lib/common.sh: configure_caddy_for_service now accepts either a plain
  port number (localhost:PORT fallback) or container:port (preferred).
  The Caddyfile entry uses the container name for direct Docker DNS routing.
- services/caddy.sh: remove extra_hosts hack; update Caddyfile template
  comments to show container_name:port format
- All service files: update configure_caddy_for_service calls to pass
  container_name:internal_port (e.g. "filebrowser:80", "mealie:9000").
  Services using network_mode:host keep plain port numbers.
- tools/manage_users.sh: new FileBrowser user-management script (deployed
  to ~/docker/filebrowser/ during installation). Manages users via the
  FileBrowser REST API: list, add, delete, passwd, scope, info commands.
  Documents username format (letters/numbers/hyphens/underscores),
  password rules (min 8 chars, letter + number required), and scope path
  convention relative to /srv (= FB_PATH on the host).

https://claude.ai/code/session_01UZus2Q9gNTfUdqSMrhuX29

services/homeassistant.sh

@@ -91,7 +91,11 @@ HA_CONFIG
     echo ""
     log_success "Home Assistant configured at $HOMEASSISTANT_DIR"
 
-    configure_caddy_for_service "Home Assistant" "8123" "home"
+    if [ "$HA_NETMODE" = "2" ]; then
+        configure_caddy_for_service "Home Assistant" "8123" "home"
+    else
+        configure_caddy_for_service "Home Assistant" "homeassistant:8123" "home"
+    fi
 
     local START_HA=""
     prompt_yn "Start Home Assistant now? (y/n):" "y" START_HA