Identify the bot's web callers by Discord id, and isolate the bot's network

authentik/vanguard-profile-scope-mapping.py (new, and the first time that mapping is version-controlled rather
than pasted from the docs) emits the Discord snowflake from the account's source connection alongside the
inherited groups, so the bot never has to match a name.

docker-compose.yml: discord-bot moves to its own network. It trusts the identity headers Caddy injects, and it
shared the default bridge with jellyfin, copyparty, syncthing, gitea, act_runner and cadvisor, any of which
could reach :8000 directly and forge them. It needs no sibling container: Caddy uses the published loopback
port and MariaDB is reached through host.docker.internal.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -236,6 +236,11 @@ services:
       - /srv/appdata/discord-bot:/data    # persistent scratch (sqlite, caches) if the bot wants files
     extra_hosts:
       - "host.docker.internal:host-gateway"
+    networks:
+      - botnet                          # its OWN network: the bot trusts the identity headers Caddy injects, so
+                                        # nothing else must be able to reach :8000 and forge them. Caddy is on the
+                                        # host network and uses the published 127.0.0.1:8000; MariaDB is reached
+                                        # through host.docker.internal. The bot needs no sibling container.
     depends_on:
       mariadb: { condition: service_healthy }
     restart: unless-stopped
@@ -340,6 +345,9 @@ services:
     privileged: true
     restart: unless-stopped
 
+networks:
+  botnet:                               # isolates discord-bot from the shared default network (see above)
+
 volumes:
   copyparty_hist:
   caddy_data: