Pin app-network subnet to match trusted proxy CIDR

Gin's trusted proxies list is hardcoded to 172.28.0.0/16, but Docker was
assigning the bridge network whatever subnet was free, so c.ClientIP()
often returned nginx's container IP instead of the real client.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -1,6 +1,9 @@
 networks:
     app-network:
         driver: bridge
+        ipam:
+            config:
+                - subnet: 172.28.0.0/16
 
 volumes:
     dbdata: