fix: scope headless-shell to a dedicated network, off the Traefik proxy network

Prod override put headless-shell on the externally-managed `proxy`
network so manga-api (confined there for Traefik routing) could still
resolve it. That reopened CDP (port 9222, raw remote code execution)
to every other container on that shared network, not just manga-api.

Give both services a project-private `browser` network (defined in
the base compose file, not `internal: true` since headless Chrome
needs outbound access to kagane.to). manga-api joins both `proxy` and
`browser` in the prod override; headless-shell never touches `proxy`.

docker-compose.prod.yml

@@ -21,8 +21,12 @@ services:
       BROWSER_WS_URL: ${BROWSER_WS_URL:-ws://headless-shell:9222}
     depends_on:
       - headless-shell
+    # `networks:` here replaces the base file's list entirely, so both must be
+    # named: `proxy` for Traefik routing, `browser` (defined in the base file)
+    # to keep reaching headless-shell without putting it on `proxy` too.
     networks:
       - proxy
+      - browser
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=${PROXY_NETWORK:-proxy}"
@@ -40,11 +44,10 @@ services:
       - "traefik.http.routers.mangaweb.tls.certresolver=${TRAEFIK_CERTRESOLVER:-le}"
       - "traefik.http.routers.mangaweb.service=mangabm"
 
-  # manga-api only joins `proxy` in this override (see above), so headless-shell
-  # has to follow it there too or DNS resolution of headless-shell:9222 breaks.
-  headless-shell:
-    networks:
-      - proxy
+  # headless-shell is untouched here: it keeps its `browser` network membership
+  # from the base file and must never join `proxy` — that network is shared
+  # with whatever else sits behind Traefik on this host, and an exposed
+  # CDP endpoint on it would be remote code execution for any of them.
 
 networks:
   proxy: