Step 1/2 of removing the direct, unencrypted LAN exposure on port 4563 (Audit Gitea #17). Attaches pawfeed to Nginx Proxy Manager's Docker network so NPM can reach it via the container DNS name (pawfeed:3000) instead of the published host port. Port mapping stays for now — removed in a follow-up commit once NPM's proxy host forward target is switched over, to avoid a downtime gap between the two changes.