marreta: content-cleaning proxy on Dankclaw, gluetun netns, guard-chained

Deploy manualdousuario/marreta (Laravel / serversideup php:8.4-fpm-nginx)
as a rootless Quadlet pair (marreta + marreta-browser/Lightpanda), both
joining gluetun's netns so all fetch egress exits the same ProtonVPN
tunnel as SearXNG.

- marreta relocated to NGINX_HTTP_PORT=8085 (netns already has searxng on
  8080); gluetun publishes 8082:8085; Caddy dials 192.168.0.143:8082.
- Guard chain: marreta.franksdank.cloud -> Anubis :8923 -> Authentik ->
  post-auth :8017 @marreta -> 8082. Access = any authenticated user.
- Secrets seeded to /home/dank/Containers/marreta/env (0600) from
  MARRETA_APP_KEY / MARRETA_ADMIN_EMAIL / MARRETA_ADMIN_PASSWORD.
- deploy-plan.py: marreta joins the gluetun netns family.
- New seam tests/marreta_quadlet.bats (17 contracts); scoping test updated
  for the widened netns family. Doc: Dankclaw/Marreta.md + index + log.

dankclaw/.env.example

@@ -61,3 +61,16 @@ AUTHENTIK_PG_PASS=changeme
 # AUTHENTIK_SECRET_KEY: the server's secret key (64+ chars).
 #   Generate: openssl rand -base64 48
 AUTHENTIK_SECRET_KEY=changeme
+
+# Marreta (content-cleaning proxy, behind the Authentik guard chain).
+# deploy-remote.sh seeds /home/dank/Containers/marreta/env from these three
+# values (only if that file does not already exist) and the marreta quadlet
+# maps them to the app's APP_KEY / ADMIN_EMAIL / ADMIN_PASSWORD.
+# MARRETA_APP_KEY: Laravel encryption key. Generate:
+#   openssl rand -base64 32
+# Changing it after first boot invalidates encrypted session/cookie data.
+MARRETA_APP_KEY=changeme
+# Admin panel login (marreta.franksdank.cloud/admin). The app creates this
+# account on first boot from these values.
+MARRETA_ADMIN_EMAIL=admin@franksdank.cloud
+MARRETA_ADMIN_PASSWORD=changeme