Caddy: keep plex.franksdank.casa HTTP-only (not in the Porkbun account)

tests/caddyfile.bats

@@ -61,8 +61,13 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
 
 # --- Phase 2: real TLS via DNS-01 (Porkbun wildcard cert) ---
 
-@test "all vhosts use TLS (no http:// site prefix remains)" {
-    ! grep -qE '^http://' "$CADDYFILE"
+@test "all vhosts use TLS except the legacy .casa name" {
+    # franksdank.casa is not in the same Porkbun account, so it cannot get
+    # a DNS-01 Let's Encrypt cert; it stays explicitly http. Every other
+    # site address must carry no http:// prefix.
+    local offenders
+    offenders=$(grep -E '^http://' "$CADDYFILE" | grep -v 'plex\.franksdank\.casa' || true)
+    [ -z "$offenders" ] || { echo "non-.casa http:// vhosts: $offenders"; return 1; }
 }
 
 @test "the Caddyfile configures the Porkbun DNS-01 provider globally" {