feat: EASY_PROXY_NETWORK — declarative edge network for the proxy (#23)

[montoyaedu]

Problem

easy proxy create ran docker run with no --network — the proxy landed on the default bridge. Reaching backends in other Docker networks required a manual docker network connect, a state invisible to easy and lost when the container is recreated — the root cause of the recent outage.

Fix

Make the proxy's network declarative — a single dedicated edge network (chosen over multi-network: the proxy on one network is the security boundary).

• EASY_PROXY_NETWORK — when set, easy proxy create does docker run --network "$EASY_PROXY_NETWORK", creating the network if missing. Unset → default bridge, backward compatible. Recreating the proxy now keeps its connectivity.
• easy proxy attach|detach <container> — connect/disconnect a site container to/from the edge network (onboard existing "zombie" sites).
• easy proxy networks [prune] — audit the networks the proxy is joined to; prune disconnects it from every network other than the edge one (cleans up the post-outage "joined to everything" state).

Changes

• commands/proxy.sh — network logic in create; attach/detach/networks subcommands + help.
• test/network.bats — 9 tests; test_helper.bash — mock_docker_record, mock_docker_multinet; easy_setup unsets EASY_PROXY_NETWORK for isolation.
• CLAUDE.md, README.md, CHANGELOG.md updated.

Test plan

TDD — 9 tests written first, watched fail, then made green.

npm run lint   # exits 0
bats test/     # 38/38 (29 + 9 new)

Closes #23

🤖 Generated with Claude Code