fix(openclaw): remove --network=host, use bridge network

- Drops --network=host from OpenClaw container
- Container now runs on Podman's default bridge network
- Gateway port already mapped via ports config (127.0.0.1:18789:8080)
- Container retains outbound internet access for Discord API, model providers, etc.
- Cannot reach other host services (Forgejo, Vaultwarden, etc.) — principle of least privilege

Note: If OpenClaw needs to reach local services in the future, add explicit
extraOptions like --network=bridge or create a shared Podman network.

modules/openclaw-podman.nix

@@ -1,5 +1,5 @@
 # OpenClaw Podman Module
-# Provides: AI Agent with Discord integration running in a container
+# Provides: AI Agent with Discord integration running in an isolated container
 #
 # Usage:
 #   myModules.openclaw-podman = {
@@ -39,7 +39,7 @@ in
     # Enable podman
     myModules.podman.enable = true;
 
-    # OpenClaw container
+    # OpenClaw container (bridge network — isolated from host services)
     virtualisation.oci-containers.containers."openclaw" = {
       image = "ghcr.io/openclaw/openclaw:latest";
       ports = [ "127.0.0.1:${toString cfg.port}:8080" ];
@@ -50,9 +50,6 @@ in
         "${./openclaw-config.json}:/home/node/.openclaw/openclaw.json:ro"
         "openclaw-data:/home/node/.openclaw"
       ];
-      extraOptions = [
-        "--network=host"
-      ];
     };
   };
 }