docker: NPM joins dmtools_default, not a shared proxy network

NPM (nginx_app_1) is connected to each stack's own default network by
hand, not to a shared docker_default. Drop the unused external `proxy`
network from the compose file; nginx just lives on dmtools_default.
setup.sh now connects NPM to it (no-op if already connected) and prints
the proxy-host settings.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -1,9 +1,17 @@
 # dmtools stack - servers only (testing + live). Not used locally.
 #
-# Reached only through the shared Nginx Proxy Manager, which terminates TLS for
-# dmtools.fvandenberg.nl and forwards to the `nginx` container by name over the
-# external `docker_default` network. Published host ports are bound to loopback
-# for local curl / DB-client access on the server itself.
+# Reached through Nginx Proxy Manager, which terminates TLS for
+# dmtools.fvandenberg.nl and forwards to the `nginx` container by name.
+# NPM is not on a shared proxy network here - it is connected to each
+# stack's own default network by hand. After the first `up`, run once:
+#
+#   docker network connect dmtools_default nginx_app_1
+#
+# (NPM keeps that connection across restarts; only needed again after a
+# `docker compose down` removes the network.)
+#
+# Published host ports are bound to loopback for local curl / DB-client
+# access on the server itself.
 #
 # Bring up with docker/setup.sh (pins the compose project name to `dmtools`).
 
@@ -35,9 +43,6 @@ services:
       - ./docker/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
     depends_on:
       - php
-    networks:
-      - default
-      - proxy
     restart: unless-stopped
 
   database:
@@ -66,10 +71,3 @@ services:
 volumes:
   database_data:
   php_var:
-
-networks:
-  # Pre-existing network the server's Nginx Proxy Manager uses to reach backend
-  # containers. Created outside this stack - must already exist on the host.
-  proxy:
-    name: docker_default
-    external: true