chore(deploy): IPv6 on Caddy's network, so IPv6 visitors keep their addresses

Caddy's network had IPv4 alone, so Docker's userland proxy forwarded
every IPv6 visitor to Caddy from the network's gateway, and the server
counted all of them as one network (the second reading's M5, reasoned).
The edge network gets a unique local /64 (fd4a:6c6b:7e80::/64), Caddy a
fixed address in it beside its IPv4 one, both trusted as the proxy; the
CI runner's unit denies fd00::/8 and its sandbox check tries Caddy's IPv6
address too. A commit of its own: it needs Docker 27 or later with
ip6tables on the server and the network made anew (compose down, never
-v, then up), checked by hand first (NEXT.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

.forgejo/workflows/ci.yaml

@@ -48,6 +48,10 @@ jobs:
           if timeout 5 bash -c 'exec 3<>/dev/tcp/172.17.0.1/443' 2>/dev/null; then
             fail "Docker's network is reachable"
           fi
+          # Caddy's own network by IPv6 too, where it has an address there.
+          if timeout 5 bash -c 'exec 3<>/dev/tcp/fd4a:6c6b:7e80::2/443' 2>/dev/null; then
+            fail "Caddy's IPv6 network is reachable"
+          fi
           echo "This job can neither see nor reach production."
 
       # A commit that passed this job before isn't checked again: a fast-forward merge