feat(infra): enable IPv6 egress on Docker compose networks

The journal container could not reach v6-only fediverse instances
(e.g. social.ullrich.is) because the compose project network was
IPv4-only. The flagship host has working IPv6, and Docker >= 27
auto-allocates a ULA subnet with NAT66 masquerading when a network
sets enable_ipv6, so the fix is a one-line opt-in per network.

Applying it to an existing deployment requires recreating the
network (docker compose down && up -d) — a brief full-stack
restart on the flagship and the persistent staging project.
PR-preview networks are created fresh per PR and need nothing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infrastructure/docker-compose.staging.yml

@@ -109,6 +109,12 @@ services:
           memory: 256M
 
 networks:
+  # IPv6 egress for staging/preview journals, matching production — see
+  # the production compose file for details. Preview networks are created
+  # fresh per PR; the persistent staging network needs a one-time
+  # down/up to pick this up.
+  default:
+    enable_ipv6: true
   trails-shared:
     external: true
     name: trails-shared

infrastructure/docker-compose.yml

@@ -250,7 +250,13 @@ services:
 
 networks:
   # Default project network — kept implicit for production services.
+  # IPv6 is enabled so the journal can federate with v6-only instances
+  # (e.g. social.ullrich.is). Docker ≥27 auto-allocates a ULA subnet and
+  # NAT66-masquerades egress via the host's public v6 address.
+  # NOTE: flipping this on an existing deployment requires recreating the
+  # network: `docker compose down && docker compose --env-file .env up -d`.
   default:
+    enable_ipv6: true
   # Created by this compose project with a fixed (un-namespaced) name so the
   # staging compose project can attach to it via `external: true`. Only
   # postgres is joined here on the production side; staging containers join