fix: preserve mock API routing across analyzer networks

[pmanko]

Summary

• create per-analyzer Docker bridge networks as internal networks
• preserve the mock API container default route while simulators and the Bridge attach dynamically
• add a focused network-manager regression assertion

Why

The worktree-isolated OpenELIS analyzer harness creates several dynamic analyzer networks. On Docker Desktop, attaching ordinary bridge networks replaced the mock API container default route, so later scenario setup and cleanup could no longer reach the published API. Internal analyzer-only networks keep that traffic isolated without becoming default egress routes.

Validation

• python3 -m unittest test_analyzer_network_manager test_analyzers_api
• full OpenELIS scripts/dev-stack up initialized all analyzer scenarios through services
• scripts/dev-stack down cleaned analyzer networks through the mock API without the prior timeout

Compatibility

This is additive to network creation and requires no API or configuration changes. Older OpenELIS harness revisions continue to use the same mock API contract.

Companion to OpenELIS-Global-2 PR #4116, the OGC-782 R10 analyzer-ingress security stack entry.