- Use list form for `networks: [sni]` on services that need no
  per-network config; keep map form only on `web` where ipv4_address
  requires it.
- README: note that the 172.28.0.0/24 subnet can be changed if it
  collides with an existing host network (and remind to update both
  files in lockstep).
- README: caveat that IPv6 fronting may lose the real client IP in
  Caddy's logs because mtg constructs a mixed-family PROXY v2 header
  (IPv6 source, IPv4 destination); Telegram traffic unaffected.