fix(deploy): server on host network so it sees the booth LAN / device VLAN

In prod the containerized server sat on the Docker bridge (172.18.0.x) and could
only see eth0 — so the setup backend-IP picker (net.ts networkInterfaces) showed
just the Docker IP, the server couldn't reach the relay or fetch Hikvision ISAPI
snapshots, and push devices (readers/cameras) couldn't reach it. The server is the
ONLY container doing device I/O, so put it on the HOST network namespace.

- docker-compose.prod.yml: server + proxy → network_mode: host (server detaches the
  base `parking` network via `networks: !reset []`). server VISION_URL=127.0.0.1:8089.
  vision stays BRIDGED (it never touches a device — the server hands it JPEG bytes)
  but publishes 8089 on 127.0.0.1 only, so the host-net server reaches it over
  loopback while the ANPR service stays off the LAN.
- docker-compose.yml: VISION_URL is now ${VISION_URL:-http://vision:8089} so dev keeps
  compose-DNS service-name routing; prod overrides to loopback.
- Caddyfile: reverse_proxy 127.0.0.1:3000 (was server:3000 — service DNS doesn't
  resolve on host net). Dev doesn't use Caddy, so unaffected.

Merge validated for both envs (booth.sh config, exit 0). Host-net side effect: the
container ping_group_range sysctl is a no-op — the HOST must set it for reader ICMP
liveness (see appliance-provisioning).

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

docker-compose.yml

@@ -13,8 +13,11 @@ services:
     restart: unless-stopped
     environment:
       DATABASE_URL: /data/parking.sqlite
-      # Reach the vision service over the private compose network by service name.
-      VISION_URL: http://vision:8089
+      # Reach the vision service. DEV: the private compose-network service name (`vision`).
+      # PROD: the server runs on the HOST network (to see the booth LAN / device VLAN — it's the
+      # only container doing device I/O), where compose DNS doesn't resolve, so the prod override
+      # sets VISION_URL=http://127.0.0.1:8089 and vision publishes 8089 on the host loopback.
+      VISION_URL: ${VISION_URL:-http://vision:8089}
       VISION_ENABLED: ${VISION_ENABLED:-1}
       # JWT signing secret MUST be provided at deploy (no insecure default — see auth.ts).
       JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in the env/.env}