Per-app network isolation from the shared `tipi_main_network` (security hardening)

Hi! Thanks for this project, I really like it!

One area that might be worth tightening: every app's main service shares tipi_main_network — with each other and with the core services (runtipi-db/Postgres, runtipi-queue/RabbitMQ, the runtipi backend, Traefik). So any app's main container can open network connections to:

• other apps' main services (including ones meant to be reached only via the authenticated proxy), and
• the core Postgres / RabbitMQ.

Where I see it:

• packages/backend/src/modules/docker/builders/compose.builder.ts — main services (is_main / add_to_main_network) get added to tipi_main_network.
• docker-compose.prod.yml — runtipi-db, runtipi-queue, runtipi, Traefik are all on tipi_main_network.

Why it might be worth hardening (defense-in-depth): if a single app is ever compromised (e.g. a bad/supply-chain image), it can move laterally to other apps or poke at the core DB/queue instead of being confined. Sidecars are already nicely isolated per-app — this is just about the shared main network.

A few possible directions (just ideas, whichever fits the architecture):

• Only Traefik needs to reach each app's main service — could Traefik join each per-app network instead of all apps sharing one flat network?
• Put the core services (Postgres/RabbitMQ) on a separate internal network apps don't join.
• An opt-in "isolated app" toggle for untrusted apps.

Fully understand the trade-offs (simplicity, routing, DNS), and this is hardening rather than an active bug — just flagging in case it's useful. Happy to help test.

(Heads up: I put this together with AI assistance — Claude Opus 4.8 — so please sanity-check the code references.)

Thanks!