fix(compose): scope upstream spoof aliases to mirror mode

The spoof aliases (maven.neoforged.net, libraries.minecraft.net, etc.) hijacked
those hostnames for every mcnet container, so the ONLINE NeoForge install during
pre-bake hit the empty mirror (cert path failure). Moved them to the mirror
override; core/static modes resolve the real upstreams.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.mirror.yml

@@ -10,3 +10,16 @@ services:
     volumes:
       - ./caddy/conf.d/20-mirror.caddy:/etc/caddy/conf.d/20-mirror.caddy:ro
       - ./mirror/upstream:/srv/mirror:ro
+    networks:
+      mcnet:
+        # Spoof the real upstream hosts -> Caddy (air-gap runtime only). Includes
+        # the base aliases because compose replaces (not merges) the alias list.
+        aliases:
+          - "auth.${BASE_DOMAIN}"
+          - "packwiz.${BASE_DOMAIN}"
+          - "meta.prismlauncher.org"
+          - "piston-meta.mojang.com"
+          - "piston-data.mojang.com"
+          - "libraries.minecraft.net"
+          - "maven.neoforged.net"
+          - "resources.download.minecraft.net"