deploy.sh: restart caddy when the reload cannot be applied

A 'caddy reload' delivered over the admin API cannot apply a config
that disables the admin API -- the fix cannot ride the API it is meant
to enable (2026-08-22: admin off sat in the running config across
deploys). Track the reload result; on failure, restart the container
so it reads the rendered file on start.

tests/deployment_flow.bats

@@ -45,6 +45,14 @@ load helpers
     grep -q 'caddy reload' "$REPO_ROOT/scripts/deploy.sh"
 }
 
+@test "deploy.sh restarts caddy when the reload cannot be applied" {
+    # If the running config has the admin API disabled (or the API is down),
+    # 'caddy reload' can never apply the new file -- the fix cannot be
+    # delivered over the API it is meant to enable. The fallback is a
+    # container restart, which always reads the file.
+    grep -q 'podman restart caddy' "$REPO_ROOT/scripts/deploy.sh"
+}
+
 @test "deploy.sh Caddyfile render survives a slash-bearing bcrypt hash" {
     local hash='$2a$14$dndiQ9EaycJv0w3Gp2oAYO/xH6O9x2ZRhMLJdCxrgi9rMn1te9D/spy'
     local rendered