feat: add management stack (portainer, uptime-kuma, homarr)

Add portainer, uptime-kuma, and homarr on a new 'management' network, with caddy joined to it and internal-only Caddy routes for portainer/uptime/homarr/router. Widen the internal_only allowlist to also accept 172.16.0.0/12 (Docker networks) and 127.0.0.1 so container-originated and local checks pass the LAN gate.

docker-compose.yml

@@ -75,6 +75,7 @@ services:
       - media
       - famapp
       - authentik
+      - management
     ports:
       - "80:80"
       - "443:443"
@@ -594,6 +595,43 @@ services:
     depends_on:
       - hbbr
 
+  # ============================================================
+  # MANAGEMENT
+  # ============================================================
+  portainer:
+    container_name: portainer
+    image: portainer/portainer-ce:latest
+    restart: unless-stopped
+    networks:
+      - management
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /config/portainer:/data
+
+  uptime-kuma:
+    container_name: uptime_kuma
+    image: louislam/uptime-kuma:2
+    restart: unless-stopped
+    networks:
+      - management
+    volumes:
+      - /config/uptime-kuma:/app/data
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+
+  homarr:
+    container_name: homarr
+    image: ghcr.io/homarr-labs/homarr:latest
+    restart: unless-stopped
+    environment:
+      - SECRET_ENCRYPTION_KEY=98989838bf06c9e42d77944ce848963a22ab316b55a09b0d199652ef0934394f
+    networks:
+      - management
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /config/homarr/configs:/app/data/configs
+      - /config/homarr/icons:/app/public/icons
+      - /config/homarr/data:/data
+
   # ============================================================
   # UTILITIES
   # ============================================================
@@ -788,6 +826,7 @@ networks:
   media:
   famapp:
   authentik:
+  management:
 
 volumes:
   minio_data: