Caddy phase 2: TLS via Porkbun DNS-01 wildcard certs

- Caddyfile: drop http:// site prefixes, global acme_dns porkbun block,
  HTTPS redirects on the bare-IP and legacy vhosts
- new dankclaw/caddy/Containerfile: xcaddy build with caddy-dns/porkbun
- compose: caddy uses franksdank/caddy-porkbun:latest + Porkbun env vars
- deploy.sh: build the image on first deploy if missing
- .env.example: rename PORKBUN_API_SECRET -> PORKBUN_API_SECRET_KEY
  (the name the caddy-dns/porkbun module expects)
- tests: 7 new caddyfile/compose seams for the TLS config

dankclaw/compose.yaml

@@ -199,12 +199,18 @@ services:
   # REPLACE_WITH_HASH placeholder. Certs/config live under
   # /home/dank/Containers/caddy (rootless-writable).
   caddy:
-    image: docker.io/library/caddy:latest
+    # Locally built: stock Caddy + the Porkbun DNS provider
+    # (dankclaw/caddy/Containerfile). See that file for build instructions.
+    image: franksdank/caddy-porkbun:latest
     container_name: caddy
     restart: unless-stopped
     ports:
       - "80:80"
       - "443:443"
+    environment:
+      # Consumed by the Caddyfile's acme_dns block (DNS-01 wildcard certs).
+      PORKBUN_API_KEY: ${PORKBUN_API_KEY}
+      PORKBUN_API_SECRET_KEY: ${PORKBUN_API_SECRET_KEY}
     volumes:
       - /home/dank/Containers/caddy/Caddyfile:/etc/caddy/Caddyfile:ro
       - /home/dank/Containers/caddy/data:/data