fix(compose): scope upstream spoof aliases to mirror mode

The spoof aliases (maven.neoforged.net, libraries.minecraft.net, etc.) hijacked
those hostnames for every mcnet container, so the ONLINE NeoForge install during
pre-bake hit the empty mirror (cert path failure). Moved them to the mirror
override; core/static modes resolve the real upstreams.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -45,18 +45,13 @@ services:
       - ./pack:/srv/pack:ro
     networks:
       mcnet:
-        # All subdomain aliases live here (harmless when a vhost snippet isn't
-        # mounted; lets internal containers resolve them to Caddy). The spoof
-        # hosts only actually serve content when the mirror snippet is present.
+        # Only the stack's own subdomains in the base. The upstream spoof-host
+        # aliases live in docker-compose.mirror.yml — adding them here would
+        # hijack maven.neoforged.net / libraries.minecraft.net for ALL mcnet
+        # containers, breaking the ONLINE NeoForge install during pre-bake.
         aliases:
           - "auth.${BASE_DOMAIN}"
           - "packwiz.${BASE_DOMAIN}"
-          - "meta.prismlauncher.org"
-          - "piston-meta.mojang.com"
-          - "piston-data.mojang.com"
-          - "libraries.minecraft.net"
-          - "maven.neoforged.net"
-          - "resources.download.minecraft.net"
 
   drasl:
     image: unmojang/drasl:latest