DNS names: flat franksdank.cloud scheme + dnsmasq LAN DNS on dankclaw

Phase 1 of the local-DNS-name work. Users type a name, not a port.

- dnsmasq quadlet on dankclaw (rootless, slirp4netns, port 53 published):
  serves the flat name scheme from addn-hosts, upstream 1.1.1.1/1.0.0.1.
  Image built from the in-repo Containerfile (localhost/dnsmasq:latest).
- Caddyfiles (both hosts): all *.dankclaw.local / *.dankserver.local vhosts
  renamed to flat <service>.franksdank.cloud. Explicit http:// site
  addresses for now; TLS (wildcard LE via DNS-01/Porkbun) lands in phase 2.
- Drift reconciliation (live /etc/caddy/Caddyfile on dankserver differs
  from the repo): added the live-only llms.franksdank.cloud vhost
  (OpenWebUI on :3000). Dropped the legacy search vhost from dankserver
  (the name belongs to dankclaw's gluetun-routed SearXNG; the legacy
  instance stays reachable at 192.168.0.235:8081).
- Homepage service links updated to the new names.
- New test seams (TDD): tests/dnsmasq.bats (quadlet boot-persistence,
  port 53, conf/record validity, Caddyfile<->addn-hosts cross-check on
  the right host IPs); caddyfile.bats naming-convention tests updated.

LAN clients get this DNS from the SURFboard G36 (DNS Relay -> statically
configured -> 192.168.0.143); the router change is a pending user step.

dankserver/Caddyfile

@@ -1,14 +1,22 @@
 # Dankserver Caddyfile
-# Deploy: copy to /etc/caddy/Caddyfile on dankserver
+# Deploy: copy to /etc/caddy/Caddyfile on dankserver (host Caddy service)
 # See ../docs/Dankserver/ for service documentation.
+#
+# Naming: flat franksdank.cloud scheme (see docs/Infrastructure/Domain-DNS.md).
+# DNS for these names is served by the dnsmasq quadlet on dankclaw
+# (dankclaw/dnsmasq/addn-hosts) and handed to LAN clients by the SURFboard
+# G36 router (DNS Relay -> statically configured -> 192.168.0.143).
+#
+# Phase 1 uses explicit http:// site addresses (no TLS yet). Phase 2 drops
+# the prefix and adds a wildcard Let's Encrypt cert via DNS-01 (Porkbun).
 
 {
 	admin off
-	email admin@dankserver.local
+	email admin@franksdank.cloud
 }
 
 # --- Homepage (password protected) ---
-dankserver.local {
+http://dankserver.franksdank.cloud {
 	basicauth {
 		dank $2a$14$REPLACE_WITH_HASH
 	}
@@ -17,29 +25,26 @@ dankserver.local {
 }
 
 # --- Plex (existing, kept) ---
-plex.franksdank.casa {
+http://plex.franksdank.casa {
 	reverse_proxy localhost:32400
 }
 
-plex.franksdank.cloud {
-	reverse_proxy localhost:32400
-}
-
-plex.dankserver.local {
+http://plex.franksdank.cloud {
 	reverse_proxy localhost:32400
 }
 
 # --- Calibre-Web (existing, kept) ---
-books.franksdank.cloud {
+http://books.franksdank.cloud {
 	reverse_proxy localhost:8083
 }
 
-books.dankserver.local {
-	reverse_proxy localhost:8083
+# --- OpenWebUI (live name from the host Caddyfile; LLM chat UI on this host) ---
+http://llms.franksdank.cloud {
+	reverse_proxy localhost:3000
 }
 
 # --- RomM ---
-romm.dankserver.local {
+http://romm.franksdank.cloud {
 	basicauth {
 		dank $2a$14$REPLACE_WITH_HASH
 	}
@@ -47,7 +52,7 @@ romm.dankserver.local {
 }
 
 # --- Copyparty ---
-files.dankserver.local {
+http://files.franksdank.cloud {
 	basicauth {
 		dank $2a$14$REPLACE_WITH_HASH
 	}
@@ -55,7 +60,7 @@ files.dankserver.local {
 }
 
 # --- Jellyfin ---
-jellyfin.dankserver.local {
+http://jellyfin.franksdank.cloud {
 	reverse_proxy 127.0.0.1:8096
 
 	transport http {
@@ -64,36 +69,36 @@ jellyfin.dankserver.local {
 }
 
 # --- *arr Stack ---
-radarr.dankserver.local {
+http://radarr.franksdank.cloud {
 	reverse_proxy localhost:7878
 }
 
-sonarr.dankserver.local {
+http://sonarr.franksdank.cloud {
 	reverse_proxy localhost:8989
 }
 
-lidarr.dankserver.local {
+http://lidarr.franksdank.cloud {
 	reverse_proxy localhost:8686
 }
 
-readarr.dankserver.local {
+http://readarr.franksdank.cloud {
 	reverse_proxy localhost:8787
 }
 
-prowlarr.dankserver.local {
+http://prowlarr.franksdank.cloud {
 	reverse_proxy localhost:9696
 }
 
-qbittorrent.dankserver.local {
+http://qbittorrent.franksdank.cloud {
 	reverse_proxy localhost:8080
 }
 
 # --- Optional: Jackett ---
-# jackett.dankserver.local {
+# http://jackett.franksdank.cloud {
 # 	reverse_proxy localhost:9117
 # }
 
 # --- Optional: Whisparr ---
-# whisparr.dankserver.local {
+# http://whisparr.franksdank.cloud {
 # 	reverse_proxy localhost:6969
 # }