Reserve fixed IPs on the lava network so Caddy can always start

lava was created by hand without an ip_range, so any container could be
given Caddy's fixed IP (172.20.0.5). After a reboot the containers race
for the low addresses and Caddy often fails with "Address already in use".

- The docker role now creates lava as 172.20.0.0/16 with dynamic
  addresses limited to 172.20.128.0/17, so 172.20.0.x is free for fixed
  IPs, and warns if the network still has the old layout.
- Gitea gets fixed IP 172.20.0.6 once the network has the reserved range,
  since its ufw-docker SSH rule points at its IP.
- ufw-docker allow rules for Caddy (80, 443) and Gitea SSH are managed by
  the playbook and follow IP changes.
- migrate-lava-network.yml recreates the existing network once: it takes
  down every compose project on lava (volumes kept), recreates the
  network, and brings them back up, Caddy first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/tasks/infrastructure/caddy.yml

@@ -43,4 +43,12 @@
     project_src: /opt/stacks/caddy
     recreate: never
     files:
-    - compose.yml
+    - compose.yml
+
+# Lets public traffic through to Caddy. Re-adds the rule if Caddy's IP changed.
+- name: allow public traffic to caddy
+  ansible.builtin.command: /usr/local/bin/ufw-docker.sh allow caddy-caddy-1 {{ item }}
+  loop: [80/tcp, 443/tcp, 443/udp]
+  register: caddy_ufw
+  changed_when: "'Skipping' not in caddy_ufw.stdout"
+  when: not ansible_check_mode