Fix Caddy routing: use container:port via caddy_net (DoTheEvo pattern)

Undo the host.docker.internal approach from the previous commit — proper
Docker networking routes Caddy to services by container name on the shared
caddy_net, not via the host gateway.

- lib/common.sh: configure_caddy_for_service now accepts either a plain
  port number (localhost:PORT fallback) or container:port (preferred).
  The Caddyfile entry uses the container name for direct Docker DNS routing.
- services/caddy.sh: remove extra_hosts hack; update Caddyfile template
  comments to show container_name:port format
- All service files: update configure_caddy_for_service calls to pass
  container_name:internal_port (e.g. "filebrowser:80", "mealie:9000").
  Services using network_mode:host keep plain port numbers.
- tools/manage_users.sh: new FileBrowser user-management script (deployed
  to ~/docker/filebrowser/ during installation). Manages users via the
  FileBrowser REST API: list, add, delete, passwd, scope, info commands.
  Documents username format (letters/numbers/hyphens/underscores),
  password rules (min 8 chars, letter + number required), and scope path
  convention relative to /srv (= FB_PATH on the host).

https://claude.ai/code/session_01UZus2Q9gNTfUdqSMrhuX29

services/meshcentral.sh

@@ -74,7 +74,7 @@ MC_ENV
     chown -R "$ACTUAL_USER:$ACTUAL_USER" "$MC_DIR"
     log_success "MeshCentral configured at $MC_DIR"
 
-    configure_caddy_for_service "MeshCentral" "4430" "mesh"
+    configure_caddy_for_service "MeshCentral" "meshcentral:443" "mesh"
 
     write_readme "$MC_DIR" << MD
 # MeshCentral