Caddy phase 2: TLS via Porkbun DNS-01 wildcard certs

- Caddyfile: drop http:// site prefixes, global acme_dns porkbun block,
  HTTPS redirects on the bare-IP and legacy vhosts
- new dankclaw/caddy/Containerfile: xcaddy build with caddy-dns/porkbun
- compose: caddy uses franksdank/caddy-porkbun:latest + Porkbun env vars
- deploy.sh: build the image on first deploy if missing
- .env.example: rename PORKBUN_API_SECRET -> PORKBUN_API_SECRET_KEY
  (the name the caddy-dns/porkbun module expects)
- tests: 7 new caddyfile/compose seams for the TLS config

dankclaw/caddy/Containerfile

@@ -0,0 +1,22 @@
+# Caddy with the Porkbun DNS provider (github.com/caddy-dns/porkbun).
+#
+# The porkbun module lets Caddy solve Let's Encrypt DNS-01 challenges
+# directly through the Porkbun API, so the wildcard cert for
+# *.franksdank.cloud / *.franksdank.casa can be issued and renewed without
+# any port 80/443 reachability from the internet (see the Caddyfile in
+# ../Caddyfile and docs/Infrastructure/LAN-DNS.md).
+#
+# Build on dankclaw (podman rootless, same as every other container here):
+#   podman build -t franksdank/caddy-porkbun:latest -f dankclaw/caddy/Containerfile .
+#
+# The first build runs an xcaddy Go compilation and takes a few minutes.
+# Rebuild only when Caddy or the porkbun module must be updated.
+
+FROM docker.io/library/caddy:2-builder AS builder
+
+RUN xcaddy build \
+    --with github.com/caddy-dns/porkbun \
+    --output /usr/bin/caddy-porkbun
+
+FROM docker.io/library/caddy:2
+COPY --from=builder /usr/bin/caddy-porkbun /usr/bin/caddy