Challenge 2: Design an Isolated Network Layout — Possible Solution
====================================================================

networks:
  frontend:
  backend:

services:
  web:
    networks: [frontend]
  api:
    networks: [frontend, backend]
  db:
    networks: [backend]

WHY THIS WORKS AS AN ANSWER
------------------------------
This follows exactly the same layout pattern this chapter's own
frontend/backend example used, applied fresh to the new service names.

web is attached ONLY to the frontend network — it has no membership on
backend at all, meaning there is no network path from web to anything
that's only on backend.

db is attached ONLY to the backend network — symmetrically, it has no
path to anything on frontend, including web.

api is attached to BOTH networks, acting as the deliberate bridge
between them — it can reach web (shared frontend network) and db
(shared backend network), but web and db can never reach each other
directly, since they share no network membership at all. This
enforces "web can never reach db directly" at the actual network
layer, not merely as an application-level convention that could be
bypassed by a misconfigured or compromised web container.