DNS names: flat franksdank.cloud scheme + dnsmasq LAN DNS on dankclaw

Phase 1 of the local-DNS-name work. Users type a name, not a port.

- dnsmasq quadlet on dankclaw (rootless, slirp4netns, port 53 published):
  serves the flat name scheme from addn-hosts, upstream 1.1.1.1/1.0.0.1.
  Image built from the in-repo Containerfile (localhost/dnsmasq:latest).
- Caddyfiles (both hosts): all *.dankclaw.local / *.dankserver.local vhosts
  renamed to flat <service>.franksdank.cloud. Explicit http:// site
  addresses for now; TLS (wildcard LE via DNS-01/Porkbun) lands in phase 2.
- Drift reconciliation (live /etc/caddy/Caddyfile on dankserver differs
  from the repo): added the live-only llms.franksdank.cloud vhost
  (OpenWebUI on :3000). Dropped the legacy search vhost from dankserver
  (the name belongs to dankclaw's gluetun-routed SearXNG; the legacy
  instance stays reachable at 192.168.0.235:8081).
- Homepage service links updated to the new names.
- New test seams (TDD): tests/dnsmasq.bats (quadlet boot-persistence,
  port 53, conf/record validity, Caddyfile<->addn-hosts cross-check on
  the right host IPs); caddyfile.bats naming-convention tests updated.

LAN clients get this DNS from the SURFboard G36 (DNS Relay -> statically
configured -> 192.168.0.143); the router change is a pending user step.

dankclaw/Caddyfile

@@ -2,14 +2,22 @@
 # Reverse proxy for the Dankclaw stack. Caddy runs as a container on the
 # podman network; upstreams are container names. Homepage is password
 # protected. Replace the bcrypt hashes below (caddy hash-password) at deploy.
+#
+# Naming: flat franksdank.cloud scheme (see docs/Infrastructure/Domain-DNS.md).
+# DNS for these names is served by the dnsmasq quadlet on this host
+# (dankclaw/dnsmasq/addn-hosts) and handed to LAN clients by the SURFboard
+# G36 router (DNS Relay -> statically configured -> 192.168.0.143).
+#
+# Phase 1 uses explicit http:// site addresses (no TLS yet). Phase 2 drops
+# the prefix and adds a wildcard Let's Encrypt cert via DNS-01 (Porkbun).
 
 {
 	admin off
-	email admin@dankclaw.local
+	email admin@franksdank.cloud
 }
 
 # --- Homepage (password protected) ---
-dankclaw.local {
+http://dankclaw.franksdank.cloud {
 	basicauth {
 		dank $2a$14$REPLACE_WITH_HASH
 	}
@@ -18,7 +26,7 @@ dankclaw.local {
 }
 
 # --- SearXNG (behind the Gluetun tunnel) ---
-search.dankclaw.local {
+http://search.franksdank.cloud {
 	basicauth {
 		dank $2a$14$REPLACE_WITH_HASH
 	}
@@ -26,14 +34,14 @@ search.dankclaw.local {
 }
 
 # --- ComfyUI ---
-comfyui.dankclaw.local {
+http://comfyui.franksdank.cloud {
 	reverse_proxy comfyui:8188
 }
 
 # --- OpenWebUI ---
 # open-webui is a quadlet container on slirp4netns (isolated), so Caddy cannot
 # reach it by container name. Proxy to its published LAN port instead.
-chat.dankclaw.local {
+http://chat.franksdank.cloud {
 	basicauth {
 		dank $2a$14$REPLACE_WITH_HASH
 	}
@@ -41,7 +49,7 @@ chat.dankclaw.local {
 }
 
 # --- Hermes ---
-hermes.dankclaw.local {
+http://hermes.franksdank.cloud {
 	basicauth {
 		dank $2a$14$REPLACE_WITH_HASH
 	}
@@ -49,12 +57,12 @@ hermes.dankclaw.local {
 }
 
 # --- Gitea (migrated) ---
-gitea.dankclaw.local {
+http://gitea.franksdank.cloud {
 	reverse_proxy gitea-server:3000
 }
 
 # --- Grafana ---
-grafana.dankclaw.local {
+http://grafana.franksdank.cloud {
 	basicauth {
 		dank $2a$14$REPLACE_WITH_HASH
 	}
@@ -62,7 +70,7 @@ grafana.dankclaw.local {
 }
 
 # --- Prometheus ---
-prometheus.dankclaw.local {
+http://prometheus.franksdank.cloud {
 	basicauth {
 		dank $2a$14$REPLACE_WITH_HASH
 	}
@@ -70,7 +78,7 @@ prometheus.dankclaw.local {
 }
 
 # --- Loki ---
-loki.dankclaw.local {
+http://loki.franksdank.cloud {
 	basicauth {
 		dank $2a$14$REPLACE_WITH_HASH
 	}