docs(docker): note that AmneziaWG doesn't work in this image

Investigated: the image is Alpine-based, and AmneziaWG's own packaging
(DKMS module + amneziawg-tools) doesn't target Alpine/musl at all --
unlike the Debian/Ubuntu/Fedora/Arch paths install.sh already handles,
there's no package to apk add even with full host network/capabilities.
The panel already degrades gracefully (IsAwgInstalled() logs one warning
instead of retrying forever), so no code change is needed -- just made
the reason explicit at the point where a user would reach for cap_add/
network_mode to try to work around it.

docker-compose.yml

@@ -12,6 +12,15 @@ services:
     # with iptables, which needs NET_ADMIN. Without these caps a ban is logged
     # and shown in fail2ban status but never actually applied. NET_RAW covers
     # ip6tables. If you disable Fail2ban, you can drop cap_add.
+    #
+    # This does NOT make AmneziaWG inbounds work: the image is Alpine-based,
+    # and AmneziaWG's own packaging (DKMS module + amneziawg-tools) doesn't
+    # target Alpine/musl at all, unlike the Debian/Ubuntu/Fedora/Arch paths
+    # install.sh already handles. The panel itself runs fine either way --
+    # IsAwgInstalled() just logs one warning instead of retrying forever --
+    # but an AmneziaWG inbound's tunnel will never come up from this
+    # container, no matter what capabilities or network mode you add. Run
+    # natively on the host if you plan to use AmneziaWG.
     cap_add:
       - NET_ADMIN
       - NET_RAW