fix: matrix docker-network label clash + odoo res.company.ldap column rename

* sys-svc-compose/templates/networks.yml.j2: declare the per-role
  `default` network as `external: true`. The network is pre-created
  by `sys-svc-compose/tasks/utils/network/create.yml` via
  `community.docker.docker_network` (no compose labels), so the
  second `compose up` after an inter-round purge refuses with
  `network <name> was found but has incorrect label com.docker.compose.network
  set to "" (expected: "default")` — observed on web-app-matrix in
  CI run 25868178119. External lifecycle keeps compose out of the
  label race and matches the actual architecture (we manage the
  network ourselves via Ansible).

* web-app-odoo/tasks/04_ldap.yml: rename SQL column `company_id` to
  `company` in both the UPDATE and the INSERT. Odoo 19's
  `auth_ldap` model declares `company = fields.Many2one('res.company', ...)`
  (no `_id` suffix), so the actual DB column is `company`. CI run
  25868178119 failed with `column "company_id" of relation
  "res_company_ldap" does not exist`. Verified against
  https://github.com/odoo/odoo/blob/19.0/addons/auth_ldap/models/res_company_ldap.py.
  Python named-arg keys keep their `company_id` name (`ODOO_LDAP_CONFIG.company_id`
  in vars/main.yml stays as is).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

roles/sys-svc-compose/templates/networks.yml.j2

@@ -41,19 +41,15 @@ networks:
   {{ _ollama_network_name }}:
     external: true
 {% endif %}
-{# Default Network — the subnet lives at
-   roles/<role>/meta/server.yml.networks.local.subnet, materialised at
-   applications.<role>.server.networks.local.subnet. #}
+{# Default network is pre-created externally by
+   sys-svc-compose/tasks/utils/network/create.yml (docker_network), so
+   declare it `external: true` to keep compose out of its lifecycle. #}
 {% set _default_subnet = lookup('config', application_id, 'server.networks.local.subnet', '') %}
 {% if not application_id.startswith('svc-db-') and not application_id.startswith('svc-ai-') %}
   default:
 {% if _default_subnet %}
     name: {{ application_id | get_entity_name }}
-    driver: bridge
-    ipam:
-      driver: default
-      config:
-        - subnet: {{ _default_subnet }}
+    external: true
 {% endif %}
 {% endif %}
 {{ "\n" }}

roles/web-app-odoo/tasks/04_ldap.yml

@@ -21,10 +21,12 @@
     login_password: "{{ lookup('database', application_id, 'password') }}"
     login_host: "{{ lookup('database', application_id, 'reach_host') }}"
     login_port: "{{ lookup('database', application_id, 'port') }}"
+    # Odoo 19: res.company.ldap stores Many2ones as `company` / `user`
+    # (no `_id` suffix in the DB).
     query: >
       UPDATE res_company_ldap SET
         sequence = %(sequence)s,
-        company_id = %(company_id)s,
+        company = %(company_id)s,
         ldap_server_port = %(ldap_server_port)s,
         ldap_binddn = %(ldap_binddn)s,
         ldap_password = %(ldap_password)s,
@@ -58,7 +60,7 @@
     login_port: "{{ lookup('database', application_id, 'port') }}"
     query: >
       INSERT INTO res_company_ldap
-      (sequence, company_id, ldap_server, ldap_server_port, ldap_binddn, ldap_password,
+      (sequence, company, ldap_server, ldap_server_port, ldap_binddn, ldap_password,
        ldap_base, ldap_filter, "user", create_user, ldap_tls, create_date, write_date)
       VALUES (
         %(sequence)s,