fix(server): route Compose proxy through host mappings

[yanpgwang]

Summary

Make the repository's Docker Compose example use host-mapped sandbox proxy
targets and make host.docker.internal resolve on Linux. Clarify the same
network-topology requirement in the server and single-host networking docs.

Motivation

The Compose lifecycle server is attached to opensandbox-net, while sandboxes
created through the mounted Docker socket use Docker's separate default bridge.
With the historical/default proxy.resolve_internal = true, server-proxied
requests to a sandbox without an egress sidecar target its 172.17.x.x address.
That address is not normally routable from the lifecycle server container on
Linux, so /proxy/44772/ping waits until the client times out.

This can be masked when a request includes networkPolicy: those sandboxes use
the egress sidecar path, for which Docker endpoint resolution already falls back
to a host-mapped port. Switching between the two sandbox shapes can therefore
look like an intermittent lifecycle or connection-pool failure.

proxy.resolve_internal = false is the existing supported control for this
topology. The example now selects it explicitly and supplies the Linux
host-gateway mapping required by its configured docker.host_ip.

This is a follow-up to #1631: that PR introduced the routing control; this PR selects the correct mode for the repository's shipped Compose topology.

Related: #252, #404, and #1631.

Changes

• set [proxy] resolve_internal = false in server/docker-compose.example.yaml
• add host.docker.internal:host-gateway to both example containers
• document that Compose/user-defined and sandbox default bridges are separate
• point the server setup docs to [proxy] resolve_internal

Validation

• cd server && uv run pytest -q tests/test_docker_compose_example.py tests/test_config.py tests/test_docker_endpoint.py tests/test_routes_proxy.py (241 passed)
• cd server && uv run ruff check tests/test_docker_compose_example.py
• cd server && uv run pyright tests/test_docker_compose_example.py
• docker compose -f server/docker-compose.example.yaml config
• cd docs && pnpm install --frozen-lockfile && pnpm docs:build
• Linux A/B reproduction: the stock internal-IP path timed out, while the same
  sandbox passed after selecting host-mapped proxy targets:
  https://github.com/yanpgwang/mango/actions/runs/33511967527

Breaking Changes

• None
• Yes

Security

This does not add a new published port or change the example's existing Docker
port exposure. It changes only which existing path the lifecycle server uses to
reach a sandbox. Deployments should continue to restrict host-published sandbox
ports with host firewall and network policy appropriate to their trust model.

Checklist

• Linked issue / clearly described motivation
• Updated docs and example configuration
• Security impact considered
• Backward compatibility considered

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-03T06:18:13.643169Z	102567a	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 536490dd43

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[yanpgwang]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 102567a379

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".