fix(mobilizon): pin the SSO back-channel so the token exchange can connect

The server-side code-to-token call died with OAuth2.Error Connection refused, 24 times, on every /auth/keycloak/callback. The oauth2 library prints that string only for :econnrefused, so the name resolved and the connect was refused - not nxdomain, not a timeout, and not a credential or redirect_uri mismatch, which would have come back as an HTTP 400. openresty, the only ingress for the issuer vhost, logged 14 token POSTs in that window and not one from the Mobilizon address.

container_extra_hosts is the single sanctioned emitter for this pin, and its contract describes exactly this case: on an onion deployment the OIDC endpoints handed to an application are public .onion authorities, right for the browser and unroutable for its own server-side calls. f0ddb4c61 gave peertube, penpot and matrix the same line; mobilizon was missed.

The libcurl class needs a proxy instead (238b8b41f), because libcurl refuses a .onion at name resolution before it consults extra_hosts. That does not apply here: hackney resolved the name, which is what :econnrefused proves.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-mobilizon/templates/compose.yml.j2

@@ -7,6 +7,7 @@
     {{ lookup('container_ports', ['mobilizon', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
+    {{ lookup('container_extra_hosts') | indent(4) }}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}