deploy: sed delimiter '|' for the Caddyfile hash render (bcrypt contains '/')

Plus a regression seam that reproduces the render with a slash-bearing
hash.

scripts/deploy.sh

@@ -128,8 +128,9 @@ if [ '${COPY_SHARED[$TARGET]}' = '1' ]; then
   if [ -z \"\${CADDY_BASICAUTH_HASH:-}\" ]; then
     echo '  WARN: CADDY_BASICAUTH_HASH not set in .env; keeping placeholder'
   else
+    # '|' delimiter: the bcrypt hash contains '/' characters.
     mkdir -p /home/dank/Containers/caddy
-    sed \"s/REPLACE_WITH_HASH/\${CADDY_BASICAUTH_HASH}/g\" dankclaw/Caddyfile \\
+    sed \"s|REPLACE_WITH_HASH|\${CADDY_BASICAUTH_HASH}|g\" dankclaw/Caddyfile \\
       > /home/dank/Containers/caddy/Caddyfile
   fi
 fi

tests/deployment_flow.bats

@@ -33,3 +33,15 @@ load helpers
     timeout 8 ssh -o BatchMode=yes -o ConnectTimeout=5 dank@dankserver 'true' 2>/dev/null \
         || skip "dankserver not reachable from this host"
 }
+
+# Regression: the Caddyfile render step in deploy.sh must survive a bcrypt
+# hash (which contains '/' characters). Reproduce the sed expression with a
+# slash-bearing hash and confirm the placeholder is replaced.
+@test "deploy.sh Caddyfile render survives a slash-bearing bcrypt hash" {
+    local hash='$2a$14$dndiQ9EaycJv0w3Gp2oAYO/xH6O9x2ZRhMLJdCxrgi9rMn1te9D/spy'
+    local rendered
+    rendered=$(sed "s|REPLACE_WITH_HASH|${hash}|g" "$REPO_ROOT/dankclaw/Caddyfile")
+    [ -n "$rendered" ]
+    [[ "$rendered" == *"${hash}"* ]]
+    ! grep -q 'REPLACE_WITH_HASH' <<< "$rendered"
+}