marreta: content-cleaning proxy on Dankclaw, gluetun netns, guard-chained

Deploy manualdousuario/marreta (Laravel / serversideup php:8.4-fpm-nginx)
as a rootless Quadlet pair (marreta + marreta-browser/Lightpanda), both
joining gluetun's netns so all fetch egress exits the same ProtonVPN
tunnel as SearXNG.

- marreta relocated to NGINX_HTTP_PORT=8085 (netns already has searxng on
  8080); gluetun publishes 8082:8085; Caddy dials 192.168.0.143:8082.
- Guard chain: marreta.franksdank.cloud -> Anubis :8923 -> Authentik ->
  post-auth :8017 @marreta -> 8082. Access = any authenticated user.
- Secrets seeded to /home/dank/Containers/marreta/env (0600) from
  MARRETA_APP_KEY / MARRETA_ADMIN_EMAIL / MARRETA_ADMIN_PASSWORD.
- deploy-plan.py: marreta joins the gluetun netns family.
- New seam tests/marreta_quadlet.bats (17 contracts); scoping test updated
  for the widened netns family. Doc: Dankclaw/Marreta.md + index + log.

serverAppConfigs-docs/index.md

@@ -71,6 +71,7 @@ covers both workloads).
 - [[Gitea]] — Git hosting (migrated)
 - [[Postgres]] — Gitea database backend
 - [[Seerr]] — unified *arr request manager (guard-chained; fronts FrankBook-Pro's stack)
+- [[Marreta]] — content-cleaning proxy (guard-chained; shares SearXNG's Gluetun egress)
 
 ## Infrastructure