fix(infra): IPv6 belongs on trails-shared, not a staging default network

Follow-up to #466: staging and preview services attach only to the
externally-named trails-shared network (created by the production
compose project) — they have no per-project default network, so the
enable_ipv6 added to the staging file was dead config. Move the flag
to trails-shared where it takes effect.

Rollout requires recreating trails-shared on the flagship: detach
staging, previews, and production postgres, remove the network, re-up.
Production journal/planner are unaffected (they use the default
network).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infrastructure/docker-compose.staging.yml

@@ -109,12 +109,9 @@ services:
           memory: 256M
 
 networks:
-  # IPv6 egress for staging/preview journals, matching production — see
-  # the production compose file for details. Preview networks are created
-  # fresh per PR; the persistent staging network needs a one-time
-  # down/up to pick this up.
-  default:
-    enable_ipv6: true
+  # Staging/preview services attach only to trails-shared — created (and
+  # IPv6-enabled) by the production compose project. There is no per-project
+  # default network here, so v6 egress comes from trails-shared itself.
   trails-shared:
     external: true
     name: trails-shared

infrastructure/docker-compose.yml

@@ -261,8 +261,12 @@ networks:
   # staging compose project can attach to it via `external: true`. Only
   # postgres is joined here on the production side; staging containers join
   # to reach postgres by hostname.
+  # IPv6-enabled so staging/preview journals — whose only network this is —
+  # get v6 federation egress like production. Recreating it on a live host
+  # requires detaching staging, previews, and postgres first.
   trails-shared:
     name: trails-shared
+    enable_ipv6: true
 
 volumes:
   caddy_data: