fix(deploy): reuse existing proxy subnet

deploy/deploy.sh

@@ -91,6 +91,24 @@ require_var() {
   return 0
 }
 
+resolve_existing_web_proxy_subnet() {
+  if [ -n "${WEB_PROXY_SUBNET:-}" ]; then
+    return 0
+  fi
+
+  local project_name="${COMPOSE_PROJECT_NAME:-$(basename "$PWD")}" network_name subnet
+  network_name="${project_name}_web_proxy"
+  if ! docker network inspect "$network_name" >/dev/null 2>&1; then
+    return 0
+  fi
+
+  subnet="$(docker network inspect -f '{{range .IPAM.Config}}{{println .Subnet}}{{end}}' "$network_name" 2>/dev/null | head -n 1 | tr -d '[:space:]')"
+  if [[ "$subnet" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/([0-9]|[12][0-9]|3[0-2])$ ]]; then
+    export WEB_PROXY_SUBNET="$subnet"
+    echo "Reusing WEB_PROXY_SUBNET from the existing ${network_name} Docker network."
+  fi
+}
+
 validate_deploy_config() {
   local failed=0 octet subnet_address microsoft_tenant
   local -a subnet_octets=()
@@ -386,6 +404,8 @@ verify_volume_backup() {
   report_backup "$target"
 }
 
+resolve_existing_web_proxy_subnet
+
 if ! validate_deploy_config; then
   exit 1
 fi

docs/verification/sec-002-ingress-compose.md

@@ -32,7 +32,7 @@ No image was pulled and no production or persistent service was changed. Ephemer
 ## Limitations and production gates
 
 - No Traefik configuration exists in this repository. Verify its exact `Host()` rule, TLS route, replacement of forwarding headers, selected Docker network, and hostile-Host rejection on the operator host.
-- `WEB_PROXY_SUBNET` must be chosen after production Docker-network inventory; the example value is not a production fact.
+- `WEB_PROXY_SUBNET` must be chosen after production Docker-network inventory; the example value is not a production fact. Deploys may recover a missing value only from the existing Compose `web_proxy` network, preserving the already-running production CIDR without guessing a new one.
 - Host firewall and `docker ps`/published-port state are unverified.
 - The exact `nginx:1.29.8-alpine` base image was not installed locally. Syntax was checked with the existing local nginx frontend image; approved CI must build the pinned Dockerfile.
 - A complete local proxy/browser smoke was not run because rebuilding the pinned container would require an unavailable base image/package access. No browser claim is made.