Pin an explicit Docker network subnet

Docker's auto-assigned default bridge range can land on the same
block as a real LAN/VLAN on the host it's deployed to, breaking
routing to that network. Same fix already applied to zportal
(10.199.0.0/24) and kkpab (10.200.0.0/24); this one takes
10.201.0.0/24.

Not applied to the currently running deployment on this host (no
`docker compose up -d` run here) — takes effect on the next redeploy
or on a fresh clone.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gh2UXUQUVBWroWEnn1FLFG

docker-compose.yml

@@ -16,6 +16,21 @@ services:
     volumes:
       - data:/data
     restart: unless-stopped
+    networks:
+      top_tickets_net:
+        ipv4_address: 10.201.0.10
 
 volumes:
   data:
+
+# Explicit subnet — Docker's auto-assigned default bridge range (often
+# 172.17-172.31.0.0/16) can land on the same block as a real LAN/VLAN,
+# breaking routing to it from this host. Picking a private range nothing
+# else here uses avoids that; see zportal (10.199.0.0/24) and kkpab
+# (10.200.0.0/24) for the same pattern.
+networks:
+  top_tickets_net:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 10.201.0.0/24