Caddy consolidation: single Caddy on dankclaw fronts both hosts

Per user direction, Caddy runs only on dankclaw. It fronts every
service on both hosts: local services by container name, quadlet
services by published LAN port, dankserver services by published LAN
port (192.168.0.235:PORT).

- dankclaw/Caddyfile: merged vhost list (was: two Caddyfiles, one per
  host). gitea's single vhost moves in from the retired gitea-caddy
  quadlet (option B). Upstreams fixed to live reality: gitea :3000,
  search :8081 (gluetun), chat :3005 (open-webui quadlet), media
  services via 192.168.0.235. Retired: llms (open-webui on dankserver
  is removed; chat is its successor), the dankserver homepage (302 to
  the shared one).
- dankserver/Caddyfile, dankclaw/gitea/Caddyfile: deleted (git rm).
- dnsmasq addn-hosts: every name -> 192.168.0.143 (the one Caddy
  host); no .235 records, no llms.
- compose.yaml: removed the openwebui/postgres/gitea services (they
  are quadlets now); caddy service mounts the rendered Caddyfile from
  /home/dank/Containers/caddy, healthcheck probes the bare-IP
  catch-all (302).
- deploy.sh: per-target logic (dankserver = pull-only, health via the
  shared Caddy at 192.168.0.143); renders CADDY_BASICAUTH_HASH from
  the host .env into the mounted Caddyfile.
- .env.example: CADDY_BASICAUTH_HASH on dankclaw; Porkbun block
  dropped from dankserver (its Caddy is gone); SEARXNG_BASE_URL to
  the flat name; stale OPENAI_* block dropped (quadlet is
  self-contained).
- tests: caddyfile.bats now asserts the single-Caddyfile invariant;
  dnsmasq.bats cross-checks vhosts -> .143 and the retired names.

dankclaw/dnsmasq/addn-hosts

@@ -1,29 +1,33 @@
 # A records for the flat franksdank.name scheme (dnsmasq addn-hosts format:
-# <IP> <name> [<name> ...]). Every Caddy vhost name has exactly one record,
-# pointing at the host that runs it. Keep in sync with the Caddyfiles
-# (tests/dnsmasq.bats cross-checks this).
+# <IP> <name> [<name> ...]).
 #
-#   192.168.0.235 = dankserver (media/library stack)
-#   192.168.0.143 = dankclaw   (AI/search/dev stack)
+# Caddy is consolidated on dankclaw (192.168.0.143): it fronts every service
+# on both hosts, so every name resolves to that one IP. Keep in sync with the
+# Caddyfile (tests/dnsmasq.bats cross-checks this).
+#
+#   192.168.0.143 = dankclaw (runs the Caddy container + the AI/dev stack)
+#   192.168.0.235 = dankserver (media stack; reached by Caddy via published
+#                    LAN ports — no DNS records point here)
 
-# --- dankserver services ---
-192.168.0.235 dankserver.franksdank.cloud
-192.168.0.235 plex.franksdank.cloud
-192.168.0.235 plex.franksdank.casa
-192.168.0.235 books.franksdank.cloud
-192.168.0.235 llms.franksdank.cloud
-192.168.0.235 romm.franksdank.cloud
-192.168.0.235 files.franksdank.cloud
-192.168.0.235 jellyfin.franksdank.cloud
-192.168.0.235 radarr.franksdank.cloud
-192.168.0.235 sonarr.franksdank.cloud
-192.168.0.235 lidarr.franksdank.cloud
-192.168.0.235 readarr.franksdank.cloud
-192.168.0.235 prowlarr.franksdank.cloud
-192.168.0.235 qbittorrent.franksdank.cloud
-
-# --- dankclaw services ---
+# --- Homepage + legacy name ---
 192.168.0.143 dankclaw.franksdank.cloud
+192.168.0.143 dankserver.franksdank.cloud
+
+# --- Media services (dankserver, proxied) ---
+192.168.0.143 plex.franksdank.cloud
+192.168.0.143 plex.franksdank.casa
+192.168.0.143 books.franksdank.cloud
+192.168.0.143 romm.franksdank.cloud
+192.168.0.143 files.franksdank.cloud
+192.168.0.143 jellyfin.franksdank.cloud
+192.168.0.143 radarr.franksdank.cloud
+192.168.0.143 sonarr.franksdank.cloud
+192.168.0.143 lidarr.franksdank.cloud
+192.168.0.143 readarr.franksdank.cloud
+192.168.0.143 prowlarr.franksdank.cloud
+192.168.0.143 qbittorrent.franksdank.cloud
+
+# --- AI / search / dev services (dankclaw, local) ---
 192.168.0.143 search.franksdank.cloud
 192.168.0.143 comfyui.franksdank.cloud
 192.168.0.143 chat.franksdank.cloud