chore(deploy): IPv6 on Caddy's network, so IPv6 visitors keep their addresses

Caddy's network had IPv4 alone, so Docker's userland proxy forwarded
every IPv6 visitor to Caddy from the network's gateway, and the server
counted all of them as one network (the second reading's M5, reasoned).
The edge network gets a unique local /64 (fd4a:6c6b:7e80::/64), Caddy a
fixed address in it beside its IPv4 one, both trusted as the proxy; the
CI runner's unit denies fd00::/8 and its sandbox check tries Caddy's IPv6
address too. A commit of its own: it needs Docker 27 or later with
ip6tables on the server and the network made anew (compose down, never
-v, then up), checked by hand first (NEXT.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/runner/forgejo-runner.service

@@ -43,7 +43,7 @@ ReadWritePaths=/var/lib/forgejo-runner
 PrivateTmp=yes
 ProtectProc=invisible
 InaccessiblePaths=-/run/docker.sock -/run/containerd -/var/lib/docker
-IPAddressDeny=172.16.0.0/12 192.168.0.0/16
+IPAddressDeny=172.16.0.0/12 192.168.0.0/16 fd00::/8
 NoNewPrivileges=yes
 CapabilityBoundingSet=
 AmbientCapabilities=