Caddy phase 2: TLS via Porkbun DNS-01 wildcard certs

- Caddyfile: drop http:// site prefixes, global acme_dns porkbun block,
  HTTPS redirects on the bare-IP and legacy vhosts
- new dankclaw/caddy/Containerfile: xcaddy build with caddy-dns/porkbun
- compose: caddy uses franksdank/caddy-porkbun:latest + Porkbun env vars
- deploy.sh: build the image on first deploy if missing
- .env.example: rename PORKBUN_API_SECRET -> PORKBUN_API_SECRET_KEY
  (the name the caddy-dns/porkbun module expects)
- tests: 7 new caddyfile/compose seams for the TLS config

scripts/deploy.sh

@@ -137,6 +137,10 @@ fi
 
 if [ '${COMPOSE_UP[$TARGET]}' = '1' ]; then
   echo '[4/4] Restarting stack...'
+  if ! podman image exists franksdank/caddy-porkbun:latest; then
+    echo '  franksdank/caddy-porkbun image missing; building it (a few minutes)...'
+    podman build -t franksdank/caddy-porkbun:latest -f dankclaw/caddy/Containerfile .
+  fi
   podman-compose -f '${COMPOSE[$TARGET]}' up -d --pull=missing
 else
   echo '[4/4] Skipping compose restart (stack runs as bare containers on this host)'