Homepage (TDD slice 5): the Caddyfile auth split

Red tests first.
- tests/homepage_caddy.bats: the homepage site block carries a root hash and
  a distinct /admin/-scoped admin hash (Q18/Q38), and serves /srv/homepage.
- dankclaw/Caddyfile: the homepage block now uses named matchers -
  @user (not /admin/*) with the shared hash, @admin (/admin/*) with the
  operator-only hash (REPLACE_WITH_ADMIN_HASH, rendered from CADDY_ADMIN_HASH
  at deploy). Both placeholders are distinct.

dankclaw/Caddyfile

@@ -46,9 +46,14 @@
 
 # --- Homepage (password protected) ---
 dankclaw.franksdank.cloud {
-	basicauth {
+	@admin path /admin/*
+	@user not path /admin/*
+	basicauth @user {
 		dank REPLACE_WITH_HASH
 	}
+	basicauth @admin {
+		frank REPLACE_WITH_ADMIN_HASH
+	}
 	root * /srv/homepage
 	file_server
 }