Caddy consolidation: single Caddy on dankclaw fronts both hosts

Per user direction, Caddy runs only on dankclaw. It fronts every
service on both hosts: local services by container name, quadlet
services by published LAN port, dankserver services by published LAN
port (192.168.0.235:PORT).

- dankclaw/Caddyfile: merged vhost list (was: two Caddyfiles, one per
  host). gitea's single vhost moves in from the retired gitea-caddy
  quadlet (option B). Upstreams fixed to live reality: gitea :3000,
  search :8081 (gluetun), chat :3005 (open-webui quadlet), media
  services via 192.168.0.235. Retired: llms (open-webui on dankserver
  is removed; chat is its successor), the dankserver homepage (302 to
  the shared one).
- dankserver/Caddyfile, dankclaw/gitea/Caddyfile: deleted (git rm).
- dnsmasq addn-hosts: every name -> 192.168.0.143 (the one Caddy
  host); no .235 records, no llms.
- compose.yaml: removed the openwebui/postgres/gitea services (they
  are quadlets now); caddy service mounts the rendered Caddyfile from
  /home/dank/Containers/caddy, healthcheck probes the bare-IP
  catch-all (302).
- deploy.sh: per-target logic (dankserver = pull-only, health via the
  shared Caddy at 192.168.0.143); renders CADDY_BASICAUTH_HASH from
  the host .env into the mounted Caddyfile.
- .env.example: CADDY_BASICAUTH_HASH on dankclaw; Porkbun block
  dropped from dankserver (its Caddy is gone); SEARXNG_BASE_URL to
  the flat name; stale OPENAI_* block dropped (quadlet is
  self-contained).
- tests: caddyfile.bats now asserts the single-Caddyfile invariant;
  dnsmasq.bats cross-checks vhosts -> .143 and the retired names.

dankclaw/.env.example

@@ -3,7 +3,7 @@
 
 # SearXNG
 SEARXNG_SECRET=changeme
-SEARXNG_BASE_URL=http://search.dankclaw.local/
+SEARXNG_BASE_URL=http://search.franksdank.cloud/
 
 # Gluetun VPN (see https://github.com/qdm12/gluetun-wiki)
 # Single-peer WireGuard model. Fill from your provider's WireGuard config.
@@ -24,10 +24,10 @@ GITEA_DB_PASSWORD=changeme
 GRAFANA_ADMIN_USER=admin
 GRAFANA_ADMIN_PASSWORD=changeme
 
-# OpenWebUI -> llama.cpp on Dankserver (frank-default-large, port 7770)
-# 2026-08-17 redo: the llama.cpp box moved from Dankclaw to Dankserver.
-OPENAI_API_BASE_URL=http://192.168.0.235:7770/v1
-OPENAI_API_KEY=not-needed
+# Caddy (the homelab's single reverse proxy, on this host)
+# bcrypt hash of the homepage/protected-vhost password (caddy hash-password).
+# deploy.sh renders it into /home/dank/Containers/caddy/Caddyfile.
+CADDY_BASICAUTH_HASH=changeme
 
 # Hermes -> Signal (signal-cli daemon on the host, port 8080)
 # E.164 number of the linked Signal account (your primary number, for Note-to-Self).