marreta: content-cleaning proxy on Dankclaw, gluetun netns, guard-chained

Deploy manualdousuario/marreta (Laravel / serversideup php:8.4-fpm-nginx)
as a rootless Quadlet pair (marreta + marreta-browser/Lightpanda), both
joining gluetun's netns so all fetch egress exits the same ProtonVPN
tunnel as SearXNG.

- marreta relocated to NGINX_HTTP_PORT=8085 (netns already has searxng on
  8080); gluetun publishes 8082:8085; Caddy dials 192.168.0.143:8082.
- Guard chain: marreta.franksdank.cloud -> Anubis :8923 -> Authentik ->
  post-auth :8017 @marreta -> 8082. Access = any authenticated user.
- Secrets seeded to /home/dank/Containers/marreta/env (0600) from
  MARRETA_APP_KEY / MARRETA_ADMIN_EMAIL / MARRETA_ADMIN_PASSWORD.
- deploy-plan.py: marreta joins the gluetun netns family.
- New seam tests/marreta_quadlet.bats (17 contracts); scoping test updated
  for the widened netns family. Doc: Dankclaw/Marreta.md + index + log.

scripts/deploy-remote.sh

@@ -89,7 +89,7 @@ service_is_allowed() {
         dankclaw:loki|dankclaw:alloy|dankclaw:node-exporter|\
         dankclaw:authentik-postgres|dankclaw:authentik-server|\
         dankclaw:authentik-worker|dankclaw:authentik-outpost|dankclaw:authentik-outpost-ldap|dankclaw:anubis|\
-        dankclaw:caddy|dankclaw:homepage|dankclaw:seerr|\
+        dankclaw:caddy|dankclaw:homepage|dankclaw:seerr|dankclaw:marreta|\
         dankclaw:frank-large|\
         dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\
         dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|dankserver:plex|dankserver:tautulli|\
@@ -508,6 +508,38 @@ deploy_searxng_valkey() {
     systemctl --user restart searxng-valkey.service searxng.service
 }
 
+# Marreta's secrets are seeded into a per-service env file under the deploy
+# user's home (rootless-readable), following the grafana convention rather
+# than the /opt/searxng one, so the rootless unit can read it without any
+# ownership gymnastics. Only the three MARRETA_* values are copied; the
+# quadlet maps them to the app's APP_KEY / ADMIN_EMAIL / ADMIN_PASSWORD.
+seed_marreta_env() {
+    local dest=/home/dank/Containers/marreta/env
+    mkdir -p /home/dank/Containers/marreta
+    if [[ ! -f "$dest" ]]; then
+        awk -F= '/^MARRETA_APP_KEY=/ || /^MARRETA_ADMIN_EMAIL=/ || /^MARRETA_ADMIN_PASSWORD=/ { print }' \
+            dankclaw/.env > "$dest"
+        chmod 600 "$dest"
+    fi
+    local var
+    for var in MARRETA_APP_KEY MARRETA_ADMIN_EMAIL MARRETA_ADMIN_PASSWORD; do
+        grep -q "^${var}=." "$dest" \
+            || { echo "marreta env missing ${var}; set it in dankclaw/.env" >&2; return 1; }
+    done
+}
+
+deploy_marreta() {
+    seed_marreta_env
+    install_quadlet marreta dankclaw/marreta/quadlet marreta
+    install_quadlet marreta-browser dankclaw/marreta/quadlet marreta-browser
+    systemctl --user daemon-reload
+    # Both containers share gluetun's netns; the tunnel must be up first.
+    systemctl --user start gluetun.service
+    # Browser before app: marreta drives the CDP endpoint on loopback.
+    systemctl --user restart marreta-browser.service
+    systemctl --user restart marreta.service
+}
+
 deploy_open_webui() {
     install_quadlet open-webui dankclaw/open-webui/quadlet open-webui
     mkdir -p /home/dank/Containers/open-webui/data
@@ -1153,6 +1185,7 @@ deploy_service() {
             ;;
         anubis) deploy_anubis ;;
         seerr) deploy_seerr ;;
+        marreta) deploy_marreta ;;
         frank-large) deploy_llm_large ;;
         frank-small) deploy_llm_small ;;
         hermes|hermes-dashboard|hermes-webui) deploy_hermes ;;