deploy: put the broker on both core + edge networks

Broker acts as the §14 door for outbound provider fetches (Gitea +
GitHub + GitLab repo lists, Slack sends, OAuth token exchange). The
prior 'internal: true'-only core network gave the container no route
to the internet, so BrokerClient::fetch_authorized() failed at DNS
before it could reach api.github.com or a self-hosted Gitea.

Adding edge keeps the broker inbound-tight (still only listens on the
unix socket inside broker_run — no exposed TCP port) while granting
outbound. Postgres access via core is preserved.

Applied by hand to /opt/clawmates/docker-compose.yml on gw-04 to
unblock the current repo-connect flow; committing here so the next
re-provision doesn't regress it. The auto-deploy timer only pulls
images — compose file drift lives with us until a future
compose-sync step is added.

deploy/compose/docker-compose.yml

@@ -73,7 +73,12 @@ services:
     volumes:
       - broker_run:/run/clawmates
       - broker_key:/etc/clawmates-broker
-    networks: [core]
+    # `core` stays for postgres access; `edge` grants OUTBOUND internet so the
+    # broker can act as the §14 door (fetch Gitea/GitHub/GitLab repo lists,
+    # forward Slack sends, etc.) without leaking any credential back to
+    # cm-api. The broker still doesn't accept inbound TCP — it only listens
+    # on the unix socket inside broker_run.
+    networks: [core, edge]
     depends_on:
       postgres:
         condition: service_healthy