fix(networking): treat host-network services as host-exposed in summaries (#1430)

The exposure summaries derived a stack's exposure solely from the declared
published-port list, so a service running with network_mode: host (which
publishes every container port on the host but declares no ports:) was
under-reported as less exposed than it actually is.

Capture network_mode in the lightweight dependency parser, add an
isHostNetwork predicate, and treat a host-network service as exposed and
publishing across the Fleet networking summary, the Stack Dossier export, and
the Networking panel, matching how the Compose Doctor already flags host
networking.

docs/features/compose-networking.mdx

@@ -26,6 +26,8 @@ Each service lists its published ports with the interface they bind to:
 - **loopback** marks a port bound only to `127.0.0.1`, reachable only from the host itself.
 - A specific address is shown as-is.
 
+A service running with `network_mode: host` is treated as **host-exposed**: it publishes every container port directly on the host, so it counts as exposed regardless of whether it declares any `ports:`. The exposure summary reflects that even when the port list is empty.
+
 The tab also surfaces each service's network membership and aliases, `network_mode` (`host`, `none`, `service:`, and `container:` modes are called out), and `extra_hosts` entries.
 
 ## Exposure intent