marreta: content-cleaning proxy on Dankclaw, gluetun netns, guard-chained

Deploy manualdousuario/marreta (Laravel / serversideup php:8.4-fpm-nginx)
as a rootless Quadlet pair (marreta + marreta-browser/Lightpanda), both
joining gluetun's netns so all fetch egress exits the same ProtonVPN
tunnel as SearXNG.

- marreta relocated to NGINX_HTTP_PORT=8085 (netns already has searxng on
  8080); gluetun publishes 8082:8085; Caddy dials 192.168.0.143:8082.
- Guard chain: marreta.franksdank.cloud -> Anubis :8923 -> Authentik ->
  post-auth :8017 @marreta -> 8082. Access = any authenticated user.
- Secrets seeded to /home/dank/Containers/marreta/env (0600) from
  MARRETA_APP_KEY / MARRETA_ADMIN_EMAIL / MARRETA_ADMIN_PASSWORD.
- deploy-plan.py: marreta joins the gluetun netns family.
- New seam tests/marreta_quadlet.bats (17 contracts); scoping test updated
  for the widened netns family. Doc: Dankclaw/Marreta.md + index + log.

scripts/deploy-plan.py

@@ -23,6 +23,7 @@ SERVICE_ORDER = (
     "gluetun",
     "searxng-valkey",
     "searxng",
+    "marreta",
     "pihole",
     "open-webui",
     "gitea-postgres",
@@ -67,6 +68,7 @@ DANKCLAW_SERVICES = {
     "gluetun",
     "searxng-valkey",
     "searxng",
+    "marreta",
     "pihole",
     "open-webui",
     "gitea-postgres",
@@ -279,15 +281,22 @@ def services_for_path(path: str, target: str) -> set[str]:
             if len(parts) >= 4 and parts[2] == "quadlet":
                 name = parts[3]
                 if name == "gluetun.container":
-                    # SearXNG shares Gluetun's network namespace.  A Gluetun
-                    # recreation requires both units to be restarted.
-                    _add(services, "gluetun", "searxng")
+                    # SearXNG and Marreta (+ its browser companion) share
+                    # Gluetun's network namespace.  A Gluetun recreation
+                    # tears the netns down, so every sharer must restart.
+                    _add(services, "gluetun", "searxng", "marreta")
                 elif name == "searxng.container":
                     _add(services, "searxng")
                 elif name == "searxng-valkey.container":
                     _add(services, "searxng-valkey", "searxng")
                 elif name == "searxng.network":
-                    _add(services, "gluetun", "searxng-valkey", "searxng")
+                    _add(services, "gluetun", "searxng-valkey", "searxng", "marreta")
+            return services
+        if len(parts) >= 2 and parts[1] == "marreta":
+            # One deployable owns both the app and its browser companion;
+            # both live in gluetun's netns. A change to either unit selects
+            # the marreta service, which restarts browser-then-app.
+            _add(services, "marreta")
             return services
         if len(parts) >= 2 and parts[1] == "pihole":
             _add(services, "pihole")