Fix: closing the web admin port to the internet also blocked Caddy

Confirmed live: a bare `ufw delete allow <port>` closes it on every
interface, including the caddy_net bridge — Caddy's own request to
host.docker.internal:PORT is ordinary INPUT-chain traffic as far as
UFW is concerned, not something that bypasses it just because the
source is a local container. Closing the port outright silently took
Caddy's reverse-proxy path down with it.

Added ufw_allow_from_caddy_net() to scope the port to caddy_net's own
subnet instead of leaving it fully closed — reachable from Caddy,
still closed to the public internet. Wired into both
asterisk-digital-ocean.sh and asterisk.sh in place of the plain
delete.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015X1jRGHwrvovz2qkhKfDZi

services/asterisk-digital-ocean.sh

@@ -699,7 +699,7 @@ CADDY_BLOCK
             ufw allow "${WEB_ADMIN_PORT_VAL}/tcp"
         else
             ufw delete allow "${WEB_ADMIN_PORT_VAL}/tcp" 2>/dev/null || true
-            log_info "Web admin port ${WEB_ADMIN_PORT_VAL} kept closed to the internet — Caddy fronts it locally."
+            ufw_allow_from_caddy_net "${WEB_ADMIN_PORT_VAL}"
         fi
         ufw allow 8088/tcp
         ufw allow 8089/tcp

services/asterisk.sh

@@ -528,7 +528,7 @@ ENV
         ufw allow 5061/tcp
         if [[ "$CADDY_SERVICE_CONFIGURED" == true && "$CADDY_SERVICE_MODE" == "local" ]]; then
             ufw delete allow "${WEB_ADMIN_PORT_VAL}/tcp" 2>/dev/null || true
-            log_info "Web admin port ${WEB_ADMIN_PORT_VAL} kept off the LAN — Caddy fronts it locally."
+            ufw_allow_from_caddy_net "${WEB_ADMIN_PORT_VAL}"
         else
             ufw allow "${WEB_ADMIN_PORT_VAL}/tcp"
         fi