Caddy consolidation: single Caddy on dankclaw fronts both hosts

Per user direction, Caddy runs only on dankclaw. It fronts every
service on both hosts: local services by container name, quadlet
services by published LAN port, dankserver services by published LAN
port (192.168.0.235:PORT).

- dankclaw/Caddyfile: merged vhost list (was: two Caddyfiles, one per
  host). gitea's single vhost moves in from the retired gitea-caddy
  quadlet (option B). Upstreams fixed to live reality: gitea :3000,
  search :8081 (gluetun), chat :3005 (open-webui quadlet), media
  services via 192.168.0.235. Retired: llms (open-webui on dankserver
  is removed; chat is its successor), the dankserver homepage (302 to
  the shared one).
- dankserver/Caddyfile, dankclaw/gitea/Caddyfile: deleted (git rm).
- dnsmasq addn-hosts: every name -> 192.168.0.143 (the one Caddy
  host); no .235 records, no llms.
- compose.yaml: removed the openwebui/postgres/gitea services (they
  are quadlets now); caddy service mounts the rendered Caddyfile from
  /home/dank/Containers/caddy, healthcheck probes the bare-IP
  catch-all (302).
- deploy.sh: per-target logic (dankserver = pull-only, health via the
  shared Caddy at 192.168.0.143); renders CADDY_BASICAUTH_HASH from
  the host .env into the mounted Caddyfile.
- .env.example: CADDY_BASICAUTH_HASH on dankclaw; Porkbun block
  dropped from dankserver (its Caddy is gone); SEARXNG_BASE_URL to
  the flat name; stale OPENAI_* block dropped (quadlet is
  self-contained).
- tests: caddyfile.bats now asserts the single-Caddyfile invariant;
  dnsmasq.bats cross-checks vhosts -> .143 and the retired names.

scripts/deploy.sh

@@ -26,17 +26,24 @@ set -euo pipefail
 # ---------------------------------------------------------------------------
 declare -A REMOTE_USER REMOTE_HOST REMOTE_DIR COMPOSE HEALTH_URL
 
+# Caddy is consolidated on dankclaw: it fronts both hosts' services. The
+# dankserver media stack runs as bare containers (not this repo's compose),
+# so its deploy is pull-only; health is checked against the shared Caddy.
 REMOTE_USER[dankclaw]=dank
 REMOTE_HOST[dankclaw]=dankclaw
 REMOTE_DIR[dankclaw]="/home/dank/serverAppConfigs"
 COMPOSE[dankclaw]="dankclaw/compose.yaml"
 HEALTH_URL[dankclaw]="http://127.0.0.1/"
+COMPOSE_UP[dankclaw]=1
+COPY_SHARED[dankclaw]=1
 
 REMOTE_USER[dankserver]=dank
 REMOTE_HOST[dankserver]=dankserver
 REMOTE_DIR[dankserver]="/home/dank/serverAppConfigs"
 COMPOSE[dankserver]="dankserver/compose.yaml"
-HEALTH_URL[dankserver]="http://127.0.0.1/"
+HEALTH_URL[dankserver]="http://192.168.0.143/"
+COMPOSE_UP[dankserver]=0
+COPY_SHARED[dankserver]=0
 
 TARGET="${1:-}"
 DRY_RUN=0
@@ -101,21 +108,38 @@ cd '${REMOTE_DIR[$TARGET]}'
 echo '[2/4] Pulling repo on ${TARGET}...'
 git pull origin main
 
-echo '[3/4] Copying shared configs into place...'
-mkdir -p /opt/searxng/config /opt/prometheus/config /opt/loki/config /opt/alloy/config
-cp shared/searxng/settings.yml /opt/searxng/config/settings.yml
-cp shared/searxng/limiter.toml /opt/searxng/config/limiter.toml
-cp shared/prometheus/prometheus.yml /opt/prometheus/config/prometheus.yml
-cp shared/loki/loki-config.yaml /opt/loki/config/loki-config.yaml
-cp shared/alloy/config.alloy /opt/alloy/config/config.alloy
 if [ -f .env ]; then
   echo '  .env present, using it'
 else
   echo '  WARN: no .env on target; copy the .env.example and fill it in'
 fi
 
-echo '[4/4] Restarting stack...'
-podman-compose -f '${COMPOSE[$TARGET]}' up -d --pull=missing
+if [ '${COPY_SHARED[$TARGET]}' = '1' ]; then
+  echo '[3/4] Copying shared configs into place...'
+  mkdir -p /opt/searxng/config /opt/prometheus/config /opt/loki/config /opt/alloy/config
+  cp shared/searxng/settings.yml /opt/searxng/config/settings.yml
+  cp shared/searxng/limiter.toml /opt/searxng/config/limiter.toml
+  cp shared/prometheus/prometheus.yml /opt/prometheus/config/prometheus.yml
+  cp shared/loki/loki-config.yaml /opt/loki/config/loki-config.yaml
+  cp shared/alloy/config.alloy /opt/alloy/config/config.alloy
+
+  echo '  Rendering Caddyfile (basicauth hash from .env)...'
+  set -a; . ./.env; set +a
+  if [ -z \"\${CADDY_BASICAUTH_HASH:-}\" ]; then
+    echo '  WARN: CADDY_BASICAUTH_HASH not set in .env; keeping placeholder'
+  else
+    mkdir -p /home/dank/Containers/caddy
+    sed \"s/REPLACE_WITH_HASH/\${CADDY_BASICAUTH_HASH}/g\" dankclaw/Caddyfile \\
+      > /home/dank/Containers/caddy/Caddyfile
+  fi
+fi
+
+if [ '${COMPOSE_UP[$TARGET]}' = '1' ]; then
+  echo '[4/4] Restarting stack...'
+  podman-compose -f '${COMPOSE[$TARGET]}' up -d --pull=missing
+else
+  echo '[4/4] Skipping compose restart (stack runs as bare containers on this host)'
+fi
 "
 
 if [ "$DRY_RUN" = "1" ]; then