chore(deploy): IPv6 on Caddy's network, so IPv6 visitors keep their addresses

Caddy's network had IPv4 alone, so Docker's userland proxy forwarded
every IPv6 visitor to Caddy from the network's gateway, and the server
counted all of them as one network (the second reading's M5, reasoned).
The edge network gets a unique local /64 (fd4a:6c6b:7e80::/64), Caddy a
fixed address in it beside its IPv4 one, both trusted as the proxy; the
CI runner's unit denies fd00::/8 and its sandbox check tries Caddy's IPv6
address too. A commit of its own: it needs Docker 27 or later with
ip6tables on the server and the network made anew (compose down, never
-v, then up), checked by hand first (NEXT.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/sidecars/README.md

@@ -76,8 +76,8 @@ Steps, in order; ✱ marks a step as root.
    - The wizard: an admin of a name nobody guesses, its password in a password
      manager; a library of the type Movies (or Shows, Music) on `/media/…`; remote
      connections allowed.
-   - Dashboard › Networking › **Known proxies**: `172.30.80.2` (Caddy's address on
-     `edge`). Jellyfin then sees each visitor's own address, and the tunnel as local.
+   - Dashboard › Networking › **Known proxies**: `172.30.80.2` and `fd4a:6c6b:7e80::2`
+     (Caddy's addresses on `edge`). Jellyfin then sees each visitor's own address, and the tunnel as local.
    - Dashboard › General: **Quick Connect** off, unless people sign in with it.
    - Dashboard › Users › the admin: **Hide this user from login screens**; **Allow
      remote connections to this server** off.