Caddy consolidation: single Caddy on dankclaw fronts both hosts

Per user direction, Caddy runs only on dankclaw. It fronts every
service on both hosts: local services by container name, quadlet
services by published LAN port, dankserver services by published LAN
port (192.168.0.235:PORT).

- dankclaw/Caddyfile: merged vhost list (was: two Caddyfiles, one per
  host). gitea's single vhost moves in from the retired gitea-caddy
  quadlet (option B). Upstreams fixed to live reality: gitea :3000,
  search :8081 (gluetun), chat :3005 (open-webui quadlet), media
  services via 192.168.0.235. Retired: llms (open-webui on dankserver
  is removed; chat is its successor), the dankserver homepage (302 to
  the shared one).
- dankserver/Caddyfile, dankclaw/gitea/Caddyfile: deleted (git rm).
- dnsmasq addn-hosts: every name -> 192.168.0.143 (the one Caddy
  host); no .235 records, no llms.
- compose.yaml: removed the openwebui/postgres/gitea services (they
  are quadlets now); caddy service mounts the rendered Caddyfile from
  /home/dank/Containers/caddy, healthcheck probes the bare-IP
  catch-all (302).
- deploy.sh: per-target logic (dankserver = pull-only, health via the
  shared Caddy at 192.168.0.143); renders CADDY_BASICAUTH_HASH from
  the host .env into the mounted Caddyfile.
- .env.example: CADDY_BASICAUTH_HASH on dankclaw; Porkbun block
  dropped from dankserver (its Caddy is gone); SEARXNG_BASE_URL to
  the flat name; stale OPENAI_* block dropped (quadlet is
  self-contained).
- tests: caddyfile.bats now asserts the single-Caddyfile invariant;
  dnsmasq.bats cross-checks vhosts -> .143 and the retired names.

dankserver/.env.example

@@ -22,8 +22,3 @@ JELLYFIN_PUBLISH_SERVER_URL=http://192.168.0.235:8096
 
 # *arr Stack
 ARR_TZ=America/New_York
-
-# Porkbun API (franksdank.cloud zone). Caddy uses these for DNS-01
-# Let's Encrypt wildcard cert issuance. Scope the token to this zone only.
-PORKBUN_API_KEY=changeme
-PORKBUN_API_SECRET=changeme

dankserver/Caddyfile

@@ -1,109 +0,0 @@
-# Dankserver Caddyfile
-# Deploy: copy to /etc/caddy/Caddyfile on dankserver (host Caddy service)
-# See ../docs/Dankserver/ for service documentation.
-#
-# Naming: flat franksdank.cloud scheme (see docs/Infrastructure/Domain-DNS.md).
-# DNS for these names is served by the dnsmasq quadlet on dankclaw
-# (dankclaw/dnsmasq/addn-hosts) and handed to LAN clients by the SURFboard
-# G36 router (DNS Relay -> statically configured -> 192.168.0.143).
-#
-# Phase 1 uses explicit http:// site addresses (no TLS yet). Phase 2 drops
-# the prefix and adds a wildcard Let's Encrypt cert via DNS-01 (Porkbun).
-
-{
-	admin off
-	email admin@franksdank.cloud
-}
-
-# --- Bare-IP access (health checks, convenience) ---
-:80 {
-	redir http://dankserver.franksdank.cloud/ 302
-}
-
-# --- Homepage (password protected) ---
-http://dankserver.franksdank.cloud {
-	basicauth {
-		dank $2a$14$REPLACE_WITH_HASH
-	}
-	root * /srv/homepage
-	file_server
-}
-
-# --- Plex (existing, kept) ---
-http://plex.franksdank.casa {
-	reverse_proxy localhost:32400
-}
-
-http://plex.franksdank.cloud {
-	reverse_proxy localhost:32400
-}
-
-# --- Calibre-Web (existing, kept) ---
-http://books.franksdank.cloud {
-	reverse_proxy localhost:8083
-}
-
-# --- OpenWebUI (live name from the host Caddyfile; LLM chat UI on this host) ---
-http://llms.franksdank.cloud {
-	reverse_proxy localhost:3000
-}
-
-# --- RomM ---
-http://romm.franksdank.cloud {
-	basicauth {
-		dank $2a$14$REPLACE_WITH_HASH
-	}
-	reverse_proxy localhost:8085
-}
-
-# --- Copyparty ---
-http://files.franksdank.cloud {
-	basicauth {
-		dank $2a$14$REPLACE_WITH_HASH
-	}
-	reverse_proxy localhost:3923
-}
-
-# --- Jellyfin ---
-http://jellyfin.franksdank.cloud {
-	reverse_proxy 127.0.0.1:8096
-
-	transport http {
-		versions h2c 1.1
-	}
-}
-
-# --- *arr Stack ---
-http://radarr.franksdank.cloud {
-	reverse_proxy localhost:7878
-}
-
-http://sonarr.franksdank.cloud {
-	reverse_proxy localhost:8989
-}
-
-http://lidarr.franksdank.cloud {
-	reverse_proxy localhost:8686
-}
-
-http://readarr.franksdank.cloud {
-	reverse_proxy localhost:8787
-}
-
-http://prowlarr.franksdank.cloud {
-	reverse_proxy localhost:9696
-}
-
-http://qbittorrent.franksdank.cloud {
-	reverse_proxy localhost:8080
-}
-
-# --- Optional: Jackett ---
-# http://jackett.franksdank.cloud {
-# 	reverse_proxy localhost:9117
-# }
-
-# --- Optional: Whisparr ---
-# http://whisparr.franksdank.cloud {
-# 	reverse_proxy localhost:6969
-# }