chore(mailu): pin Docker network subnet to match SUBNET; ignore runtime state

The base compose declares no network, so Docker assigns the default bridge an
arbitrary subnet that won't match mailu.env SUBNET — breaking Mailu's internal
service auth/relay. Add a docker-compose.override.yml.example that pins the
default network to 192.168.203.0/24, and gitignore the live override + Mailu
runtime state (mailu.env, certs/, data/).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ralyodio

.gitignore

@@ -6,5 +6,11 @@
 *.log
 .env
 
+# Mailu runtime: secrets, local network override, and state
+deploy/mailu/mailu.env
+deploy/mailu/docker-compose.override.yml
+deploy/mailu/data/
+deploy/mailu/certs/
+
 # Claude Code local worktrees/state
 .claude/

deploy/mailu/docker-compose.override.yml.example

@@ -0,0 +1,14 @@
+# docker-compose.override.yml — copy to docker-compose.override.yml (gitignored).
+#
+# The base docker-compose.yml does not declare a network, so Docker would assign
+# the project's default bridge an arbitrary subnet. Mailu trusts SUBNET (from
+# mailu.env) as its internal network for service-to-service auth and relaying, so
+# the real network subnet MUST equal SUBNET or internal auth/relay breaks. This
+# override pins the default network to the same subnet you set as SUBNET in
+# mailu.env (default 192.168.203.0/24). Compose loads this file automatically.
+networks:
+  default:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 192.168.203.0/24