Caddy consolidation: single Caddy on dankclaw fronts both hosts

Per user direction, Caddy runs only on dankclaw. It fronts every
service on both hosts: local services by container name, quadlet
services by published LAN port, dankserver services by published LAN
port (192.168.0.235:PORT).

- dankclaw/Caddyfile: merged vhost list (was: two Caddyfiles, one per
  host). gitea's single vhost moves in from the retired gitea-caddy
  quadlet (option B). Upstreams fixed to live reality: gitea :3000,
  search :8081 (gluetun), chat :3005 (open-webui quadlet), media
  services via 192.168.0.235. Retired: llms (open-webui on dankserver
  is removed; chat is its successor), the dankserver homepage (302 to
  the shared one).
- dankserver/Caddyfile, dankclaw/gitea/Caddyfile: deleted (git rm).
- dnsmasq addn-hosts: every name -> 192.168.0.143 (the one Caddy
  host); no .235 records, no llms.
- compose.yaml: removed the openwebui/postgres/gitea services (they
  are quadlets now); caddy service mounts the rendered Caddyfile from
  /home/dank/Containers/caddy, healthcheck probes the bare-IP
  catch-all (302).
- deploy.sh: per-target logic (dankserver = pull-only, health via the
  shared Caddy at 192.168.0.143); renders CADDY_BASICAUTH_HASH from
  the host .env into the mounted Caddyfile.
- .env.example: CADDY_BASICAUTH_HASH on dankclaw; Porkbun block
  dropped from dankserver (its Caddy is gone); SEARXNG_BASE_URL to
  the flat name; stale OPENAI_* block dropped (quadlet is
  self-contained).
- tests: caddyfile.bats now asserts the single-Caddyfile invariant;
  dnsmasq.bats cross-checks vhosts -> .143 and the retired names.

tests/dnsmasq.bats

@@ -84,18 +84,10 @@ record_ip_for() {
     awk -v n="$1" '{ip=$1; for (i=2; i<=NF; i++) if ($i==n) print ip}' "$HOSTS" | head -1
 }
 
-@test "every dankserver Caddyfile vhost has an A record on 192.168.0.235" {
-    local names n ip
-    names="$(vhost_names "$REPO_ROOT/dankserver/Caddyfile")"
-    [ -n "$names" ] || { echo "no .franksdank vhosts found in dankserver/Caddyfile"; return 1; }
-    while IFS= read -r n; do
-        [ -z "$n" ] && continue
-        ip="$(record_ip_for "$n")"
-        [ "$ip" = "192.168.0.235" ] || { echo "$n -> '$ip' (want 192.168.0.235)"; return 1; }
-    done <<< "$names"
-}
+# Caddy is consolidated on dankclaw (192.168.0.143): it fronts every service
+# on both hosts, so every vhost name resolves to that one IP.
 
-@test "every dankclaw Caddyfile vhost has an A record on 192.168.0.143" {
+@test "every Caddyfile vhost has an A record on 192.168.0.143" {
     local names n ip
     names="$(vhost_names "$REPO_ROOT/dankclaw/Caddyfile")"
     [ -n "$names" ] || { echo "no .franksdank vhosts found in dankclaw/Caddyfile"; return 1; }
@@ -106,6 +98,14 @@ record_ip_for() {
     done <<< "$names"
 }
 
+@test "no addn-hosts records point at the old per-host split (192.168.0.235)" {
+    ! awk '!/^[[:space:]]*#/ && NF {print $1}' "$HOSTS" | grep -q '^192\.168\.0\.235$'
+}
+
+@test "the retired llms name has no A record" {
+    ! grep -qE '\billms\.franksdank\.cloud\b' "$HOSTS"
+}
+
 @test "no secret material in the dnsmasq files" {
     local f
     for f in "$DNSMASQ_DIR"/*; do