feat(compose): consume network config, preserve source networks, validate refs, and support multi-file encrypted discovery

[wax911]

Summary

Resolves #65: Compose generation hardcodes network topology and encrypted env discovery, blocking stock adoption.

Changes

Network generation (gaps 1-3):

• Thread validated stack.network into GenerateOptions as required networkName; removed hardcoded NETWORK_NAME constant
• Preserve non-default merged source networks; config wins for the logical default key
• Add collectAllServiceNetworkRefs in new src/compose/networks.ts for list and map syntax validation
• Reject dangling network references and network_mode plus networks coexistence with distinct errors
• Invalid stacks excluded from generated, files, disk, render, and deploy
• Use Stack "name": reason error format for reload.ts extractStackFromError compatibility
• Fix stackctl init without --detect to write network: "traefik-public" instead of empty string

Encrypted env discovery (gap 4):

• Change secrets.encryptedFileName type to string | string[] for multi-file support
• Add normalizeEncryptedFileNames with typed { filenames, errors } result object
• Update findEncryptedEnvFiles to accept a filename list; defaults to [".env.enc"]
• Resolve config before discovery in deployPipeline
• No-config fallback to [".env.enc"] for encrypt/decrypt/clean/check (bypasses resolveConfig)
• No-argument encrypt derives plaintext names from configured encrypted names
• Fix secrets CLI dispatch to use new Command() pattern for Cliffy compatibility
• Map secrets config failures to ExitCode.UserConfigError (2)

Documentation:

• Updated README, migration.md, codemaps, and AGENTS.md for all behavior changes
• Documented network validation, multi-file secrets, no-config fallback, encrypt derivation
• Documented env status/doctor .env.enc-only limitation as known follow-up
• Narrowed SIGINT claim to streaming commands only
• Marked doctor --fix-volumes as not yet implemented
• Documented stack.networkDriver as reserved for future use

Validation

• deno task fmt:check: passed (70 files)
• deno task lint: passed (60 files)
• deno task check: passed
• deno task test: 427 passed, 0 failed

Breaking changes

These are intentional behavioral changes within 0.x versioning:

• Source non-default networks are now preserved (were previously discarded)
• Stacks with dangling network references are now rejected (were previously accepted)
• Stacks with network_mode plus explicit networks are now rejected
• NETWORK_NAME constant removed; generation requires stack.network in config
• No-argument secrets encrypt now discovers plaintext files from configured encrypted names

Known limitations

• Env status, env audit, and doctor encrypted-file checks support only .env.enc (follow-up issue planned)
• doctor --fix-volumes remains a stub
• stack.networkDriver is reserved, no consumer in this release