marreta: content-cleaning proxy on Dankclaw, gluetun netns, guard-chained

Deploy manualdousuario/marreta (Laravel / serversideup php:8.4-fpm-nginx)
as a rootless Quadlet pair (marreta + marreta-browser/Lightpanda), both
joining gluetun's netns so all fetch egress exits the same ProtonVPN
tunnel as SearXNG.

- marreta relocated to NGINX_HTTP_PORT=8085 (netns already has searxng on
  8080); gluetun publishes 8082:8085; Caddy dials 192.168.0.143:8082.
- Guard chain: marreta.franksdank.cloud -> Anubis :8923 -> Authentik ->
  post-auth :8017 @marreta -> 8082. Access = any authenticated user.
- Secrets seeded to /home/dank/Containers/marreta/env (0600) from
  MARRETA_APP_KEY / MARRETA_ADMIN_EMAIL / MARRETA_ADMIN_PASSWORD.
- deploy-plan.py: marreta joins the gluetun netns family.
- New seam tests/marreta_quadlet.bats (17 contracts); scoping test updated
  for the widened netns family. Doc: Dankclaw/Marreta.md + index + log.

dankclaw/marreta/quadlet/marreta-browser.container

@@ -0,0 +1,34 @@
+# Quadlet unit: Marreta browser companion — Lightpanda (rootless, boot-persistent).
+#
+# Install path on dankclaw: ~/.config/containers/systemd/marreta-browser.container
+# Unit name: marreta-browser.service (container name: marreta_browser)
+#
+# Lightpanda is a headless browser that exposes the Chrome DevTools Protocol
+# over a WebSocket on port 9222. Marreta drives it to render JS-heavy pages
+# the plain curl fetch cannot. It shares gluetun's network namespace so the
+# browser's OWN outbound fetches also exit the WireGuard tunnel — this is
+# required because marreta's PROXY_URL only covers the curl strategy; the
+# CDP session passes no proxy to the browser, so without netns sharing the
+# browser would leak the host's real egress IP.
+#
+# Marreta reaches it on loopback (same netns): ws://127.0.0.1:9222. No
+# published port — nothing outside the netns talks to it directly.
+# See serverAppConfigs-docs/Dankclaw/Marreta.md.
+
+[Unit]
+Description=Marreta Lightpanda browser companion container
+Wants=gluetun.service
+After=gluetun.service network.target
+
+[Container]
+ContainerName=marreta_browser
+Network=gluetun.container
+Image=docker.io/lightpanda/browser:nightly
+
+[Service]
+TimeoutStartSec=300
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=default.target