caddy: serve /img/* from the homepage root

The @data path allowlist on the post-auth listener did not include /img/*,
so docs screenshots fell through to the index.html catch-all and the
browser got 200 text/html for every PNG (docs images broken live
2026-10-08). Pinned by the homepage_caddy seam.

tests/homepage_caddy.bats

@@ -31,6 +31,9 @@ setup() {
     # can access them (the browser's Authentik session covers these fetches).
     grep -qE "@data[[:space:]]+path[[:space:]]+/services\.json[[:space:]]+/status\.json" "$CADDY"
     grep -qE "handle[[:space:]]+@data" "$CADDY"
+    # docs screenshots (/img/*) must be served from disk, not answered by the
+    # index.html catch-all (2026-10-08: PNGs came back as 200 text/html).
+    grep -qE "@data[[:space:]]+path.*(/img/\*|/img/\*\")" "$CADDY"
 }
 
 @test "the homepage revalidates its assets (no stale cache after deploys)" {