Fix compose: use default bridge network, match cashup service names

The frontend nginx proxies to 'backend:3001', so services must be named
backend/frontend. Drop the external hnf_net network (each app runs in its
own LXC) and add apparmor=unconfined for docker-in-LXC.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -1,31 +1,36 @@
 services:
-  hk-planner-backend:
+  backend:
     build: ./backend
-    container_name: hk-planner-backend
-    restart: unless-stopped
+    security_opt:
+      - apparmor=unconfined
     environment:
-      DATABASE_URL:        ${DATABASE_URL}
-      CENTRAL_AUTH_SECRET: ${CENTRAL_AUTH_SECRET}
-      SETTINGS_URL:        ${SETTINGS_URL}
-      SETTINGS_SECRET:     ${SETTINGS_SECRET}
-      APP_SLUG:            hk-planner
-    networks:
-      - hnf_net
+      - DATABASE_URL=${DATABASE_URL}
+      - CENTRAL_AUTH_SECRET=${CENTRAL_AUTH_SECRET}
+      - SETTINGS_URL=${SETTINGS_URL}
+      - SETTINGS_SECRET=${SETTINGS_SECRET}
+      - APP_SLUG=hk-planner
+      - OFFICE_IP_CHECK=${OFFICE_IP_CHECK:-disabled}
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3001/health || exit 1"]
+      interval: 10s
+      retries: 5
+      start_period: 20s
+    restart: unless-stopped
 
-  hk-planner-frontend:
+  frontend:
     build:
       context: ./frontend
       args:
         VITE_HOTEL_NAME: ${VITE_HOTEL_NAME}
-    container_name: hk-planner-frontend
-    restart: unless-stopped
+    security_opt:
+      - apparmor=unconfined
     ports:
       - "${FRONTEND_PORT:-3080}:80"
     depends_on:
-      - hk-planner-backend
-    networks:
-      - hnf_net
+      backend:
+        condition: service_healthy
+    restart: unless-stopped
 
 networks:
-  hnf_net:
-    external: true
+  default:
+    driver: bridge