fix(docker): restore outbound access for PTY shells

[alexfrmn]

What changed:

• Attach only the PTY service to a dedicated non-internal egress network.
• Retain its internal ptylon network for websocket communication.
• Add no published ports.

Validation:

• Static Compose topology check confirms PTY has no ports, uses egress plus ptylon, and ptylon remains internal.
• git diff --check.

Phoenix runtime follow-up: prove PTY outbound HTTP succeeds while host access to port 8792 stays unavailable.