Ensure caddy_net exists via require_docker instead of per-service

43 services declare caddy_net as "external: true" in their compose
file, meaning they require it to already exist — but only Caddy's own
compose file actually creates it (authelia.sh was the sole exception,
with its own inline check-and-create). Installing any of the other 42
before Caddy fails outright with "network caddy_net declared as
external, but could not be found."

Adds ensure_caddy_network to lib/common.sh, called from require_docker
(which every install_* function already calls first), so the network
exists regardless of install order without touching each service file.
Removes authelia.sh's now-redundant duplicate of the same check.

Also documents in CLAUDE.md that network_mode: host services (asterisk/
asterisk-do) need host.docker.internal, not localhost, when Caddy
reverse-proxies to them — the fix from the previous commit.

services/authelia.sh

@@ -387,13 +387,8 @@ AUTHELIA_USERS
     chown -R 1000:1000 "$AUTHELIA_DIR/config" "$AUTHELIA_DIR/data"
     log_success "Authelia configured at $AUTHELIA_DIR"
 
-    # ── Docker network ────────────────────────────────────────────────────────
-    if ! docker network ls --format '{{.Name}}' | grep -q "^${CADDY_NET}$"; then
-        docker network create "$CADDY_NET" >/dev/null 2>&1 && echo "  ✓ Created docker network ${CADDY_NET}" \
-            || echo "  ⚠ Failed to create ${CADDY_NET}"
-    else
-        echo "  ✓ Docker network ${CADDY_NET} already exists"
-    fi
+    # $CADDY_NET already exists at this point — require_docker (called at the
+    # top of this function) creates it via ensure_caddy_network in lib/common.sh.
 
     # ── Caddyfile forward-auth snippet + portal block ────────────────────────
     local CADDY_FILE="$DOCKER_DIR/caddy/Caddyfile"