Adolf: enable OpenClaw browser + local wiki network access

- openclaw.json: browser.enabled + noSandbox (containers can't sandbox) +
  ssrfPolicy.dangerouslyAllowPrivateNetwork (local *.alogins.net resolve to
  the private host gateway); "browser" added to gateway.tools.allow.
- docker-compose.yml: extra_hosts family.alogins.net / wiki.alogins.net ->
  host-gateway on both adolf and adolf-llm, so the gateway browser AND the
  Kimi CLI's fetch reach the local wikis (hairpin-NAT dodge, like matrix).

Enables Adolf to open + log into the family wiki (kb#64). Root 401 on the
openclaw-tools bridge was a separate fix (empty ADOLF_GATEWAY_TOKEN -> just
recreate the bridge container; no file change).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014t8Qg9gi7H7HtT8MncoXAB

openai/docker-compose.yml

@@ -197,6 +197,14 @@ services:
       # same fix). Caddy on the host terminates TLS on :443 and proxies to
       # synapse:8008.
       - "mtx.alogins.net:host-gateway"
+      # Local *.alogins.net web services (family wiki / OtterWiki, РодоВики) —
+      # same hairpin-NAT dodge: the public A record can't loop back through the
+      # router from inside a container, so route the hostname to the host
+      # gateway where Caddy terminates TLS on :443 and proxies to the service.
+      # Lets Adolf's OpenClaw browser reach them with the real URL + the
+      # Vaultwarden creds. Add more *.alogins.net hosts here as needed.
+      - "family.alogins.net:host-gateway"
+      - "wiki.alogins.net:host-gateway"
     cap_drop:
       - NET_RAW
       - NET_ADMIN
@@ -242,6 +250,12 @@ services:
       # this compose project's network) via shared-mcp.json's "kanboard"
       # entry — same host-gateway trick used by adolf/cognee/pipecat above.
       - "host.docker.internal:host-gateway"
+      # Local *.alogins.net web services: the Kimi CLI's own web-fetch tool
+      # runs IN THIS container, so it needs the same hairpin-NAT dodge as the
+      # adolf gateway (the public A record can't loop back through the router).
+      # Route to the host gateway where Caddy terminates TLS on :443.
+      - "family.alogins.net:host-gateway"
+      - "wiki.alogins.net:host-gateway"
     restart: unless-stopped
 
   # hindsight — Adolf memory backend, replacing cognee/cognee-mcp/cognee-llm