stage-28: make the proxy docker network name configurable per environment

On AnD0R the reverse-proxy lives on the 'backend' docker network; on
cloud.neuronetz.ai it's 'neuronetz_default'. With a hardcoded name the
cockpit ended up on a network the prod proxy couldn't see and routing
silently dropped. Network is now overridable via PSYC_PROXY_NETWORK in
.env (default 'backend' keeps dev working).

On prod, set PSYC_PROXY_NETWORK=neuronetz_default in .env before the
next compose up.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.env.example

@@ -20,6 +20,13 @@ NVD_API_KEY=
 # without a reachable acme-companion + public DNS + :443).
 # LETSENCRYPT_EMAIL=admin@neuronetz.ai
 
+# --- Production-only: the docker network the reverse-proxy is on ---
+# Cockpit must share this network with nginx-proxy + acme-companion so the
+# proxy can route to it. Default 'backend' matches AnD0R dev; on cloud
+# production this is typically 'neuronetz_default' (whatever the proxy stack
+# declares — check with `docker network ls`).
+# PSYC_PROXY_NETWORK=neuronetz_default
+
 # --- Internal service URLs — overridden in docker compose; defaults for venv CLI ---
 # PSYC_MOCK_CERT_URL=http://127.0.0.1:8770
 # PSYC_INFERENCE_URL=http://127.0.0.1:8771

docker-compose.yml

@@ -99,6 +99,10 @@ services:
               capabilities: [gpu]
 
 networks:
+  # The reverse-proxy + acme-companion need to share a docker network with the
+  # cockpit so they can see each other. The actual network name differs by
+  # environment (e.g. 'backend' in dev, 'neuronetz_default' in production), so
+  # it's overridable via PSYC_PROXY_NETWORK in .env. Default keeps dev working.
   backend:
-    name: backend
+    name: ${PSYC_PROXY_NETWORK:-backend}
     external: true