Caddy consolidation: single Caddy on dankclaw fronts both hosts

Per user direction, Caddy runs only on dankclaw. It fronts every
service on both hosts: local services by container name, quadlet
services by published LAN port, dankserver services by published LAN
port (192.168.0.235:PORT).

- dankclaw/Caddyfile: merged vhost list (was: two Caddyfiles, one per
  host). gitea's single vhost moves in from the retired gitea-caddy
  quadlet (option B). Upstreams fixed to live reality: gitea :3000,
  search :8081 (gluetun), chat :3005 (open-webui quadlet), media
  services via 192.168.0.235. Retired: llms (open-webui on dankserver
  is removed; chat is its successor), the dankserver homepage (302 to
  the shared one).
- dankserver/Caddyfile, dankclaw/gitea/Caddyfile: deleted (git rm).
- dnsmasq addn-hosts: every name -> 192.168.0.143 (the one Caddy
  host); no .235 records, no llms.
- compose.yaml: removed the openwebui/postgres/gitea services (they
  are quadlets now); caddy service mounts the rendered Caddyfile from
  /home/dank/Containers/caddy, healthcheck probes the bare-IP
  catch-all (302).
- deploy.sh: per-target logic (dankserver = pull-only, health via the
  shared Caddy at 192.168.0.143); renders CADDY_BASICAUTH_HASH from
  the host .env into the mounted Caddyfile.
- .env.example: CADDY_BASICAUTH_HASH on dankclaw; Porkbun block
  dropped from dankserver (its Caddy is gone); SEARXNG_BASE_URL to
  the flat name; stale OPENAI_* block dropped (quadlet is
  self-contained).
- tests: caddyfile.bats now asserts the single-Caddyfile invariant;
  dnsmasq.bats cross-checks vhosts -> .143 and the retired names.

dankclaw/compose.yaml

@@ -44,23 +44,10 @@ services:
       retries: 5
       start_period: 180s
 
-  # --- Chat UI + agent -----------------------------------------------------
-  openwebui:
-    image: ghcr.io/open-webui/open-webui:main
-    container_name: openwebui
-    restart: unless-stopped
-    environment:
-      OPENAI_API_BASE_URL: "${OPENAI_API_BASE_URL}"
-      OPENAI_API_KEY: "${OPENAI_API_KEY}"
-    ports:
-      - "3000:8080"
-    volumes:
-      - /opt/openwebui/data:/app/backend/data
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
+  # --- Chat UI (open-webui) ------------------------------------------------
+  # Now a boot-persistent Quadlet unit (quadlet, slirp4netns, port 3005), not
+  # a compose service. See open-webui/quadlet/open-webui.container and
+  # ../docs/Dankclaw/OpenWebUI.md.
 
   hermes:
     image: docker.io/nousresearch/hermes-agent:latest
@@ -107,50 +94,9 @@ services:
     volumes:
       - /home/dank/hermes-data:/data
 
-  # --- Git hosting (migrated from /opt/gitea) ------------------------------
-  postgres:
-    image: docker.io/library/postgres:16-alpine
-    container_name: gitea-postgres
-    restart: unless-stopped
-    environment:
-      POSTGRES_USER: gitea
-      POSTGRES_PASSWORD: "${GITEA_DB_PASSWORD}"
-      POSTGRES_DB: gitea
-    volumes:
-      - /opt/gitea/data/gitea-postgres:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U gitea"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-
-  gitea:
-    image: docker.io/gitea/gitea:latest
-    container_name: gitea-server
-    restart: unless-stopped
-    environment:
-      DATABASE_TYPE: postgres
-      DATABASE_HOST: gitea-postgres
-      DATABASE_NAME: gitea
-      DATABASE_USER: gitea
-      DATABASE_PASSWD: "${GITEA_DB_PASSWORD}"
-      DATABASE_PORT: "5432"
-      USER_UID: "1000"
-      USER_GID: "1000"
-    ports:
-      - "3001:3000"
-      - "2222:22"
-    volumes:
-      - /opt/gitea/data/gitea-gitea:/data
-      - /etc/timezone:/etc/timezone:ro
-      - /etc/localtime:/etc/localtime:ro
-    depends_on:
-      - postgres
-    healthcheck:
-      test: ["CMD", "wget", "--spider", "-q", "http://localhost:3000/"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
+  # --- Git hosting (Gitea) -------------------------------------------------
+  # Now boot-persistent Quadlet units (private bridge network, DNS enabled),
+  # not compose services. See gitea/quadlet/ and ../docs/Dankclaw/Gitea.md.
 
   # --- Observability -------------------------------------------------------
   prometheus:
@@ -247,7 +193,11 @@ services:
       timeout: 10s
       retries: 3
 
-  # --- Reverse proxy + homepage -------------------------------------------
+  # --- Reverse proxy + homepage (the homelab's single Caddy) ---------------
+  # The Caddyfile mounted here is the RENDERED copy (basicauth hash filled in
+  # from the host .env by scripts/deploy.sh); the repo copy carries the
+  # REPLACE_WITH_HASH placeholder. Certs/config live under
+  # /home/dank/Containers/caddy (rootless-writable).
   caddy:
     image: docker.io/library/caddy:latest
     container_name: caddy
@@ -256,21 +206,20 @@ services:
       - "80:80"
       - "443:443"
     volumes:
-      - ./Caddyfile:/etc/caddy/Caddyfile:ro
-      - /opt/caddy/data:/data
-      - /opt/caddy/config:/config
+      - /home/dank/Containers/caddy/Caddyfile:/etc/caddy/Caddyfile:ro
+      - /home/dank/Containers/caddy/data:/data
+      - /home/dank/Containers/caddy/config:/config
       - ../shared/homepage:/srv/homepage:ro
     depends_on:
-      - searxng
       - comfyui
-      - openwebui
       - hermes
-      - gitea
       - grafana
       - prometheus
       - loki
     healthcheck:
-      test: ["CMD", "wget", "--spider", "-q", "http://localhost:80/"]
+      # The bare-IP catch-all answers 302 (curl -f passes on <400); this
+      # proves Caddy itself is serving without touching any upstream.
+      test: ["CMD", "curl", "-sf", "-o", "/dev/null", "http://localhost:80/"]
       interval: 30s
       timeout: 10s
       retries: 3