Caddy phase 2: TLS via Porkbun DNS-01 wildcard certs

- Caddyfile: drop http:// site prefixes, global acme_dns porkbun block,
  HTTPS redirects on the bare-IP and legacy vhosts
- new dankclaw/caddy/Containerfile: xcaddy build with caddy-dns/porkbun
- compose: caddy uses franksdank/caddy-porkbun:latest + Porkbun env vars
- deploy.sh: build the image on first deploy if missing
- .env.example: rename PORKBUN_API_SECRET -> PORKBUN_API_SECRET_KEY
  (the name the caddy-dns/porkbun module expects)
- tests: 7 new caddyfile/compose seams for the TLS config

tests/caddyfile.bats

@@ -58,3 +58,40 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
 @test "the caddy service healthcheck probes the bare-IP catch-all" {
     grep -q 'curl.*-sf.*http://localhost:80/' "$REPO_ROOT/dankclaw/compose.yaml"
 }
+
+# --- Phase 2: real TLS via DNS-01 (Porkbun wildcard cert) ---
+
+@test "all vhosts use TLS (no http:// site prefix remains)" {
+    ! grep -qE '^http://' "$CADDYFILE"
+}
+
+@test "the Caddyfile configures the Porkbun DNS-01 provider globally" {
+    grep -q 'acme_dns porkbun' "$CADDYFILE"
+    grep -q '{env.PORKBUN_API_KEY}' "$CADDYFILE"
+    grep -q '{env.PORKBUN_API_SECRET_KEY}' "$CADDYFILE"
+}
+
+@test "the bare-IP catch-all redirects to the HTTPS homepage" {
+    grep -q 'redir https://dankclaw.franksdank.cloud/' "$CADDYFILE"
+}
+
+@test "the caddy service uses the locally built porkbun image" {
+    grep -q 'franksdank/caddy-porkbun' "$REPO_ROOT/dankclaw/compose.yaml"
+}
+
+@test "the caddy service passes the Porkbun credentials from .env" {
+    grep -q 'PORKBUN_API_KEY: \${PORKBUN_API_KEY}' "$REPO_ROOT/dankclaw/compose.yaml"
+    grep -q 'PORKBUN_API_SECRET_KEY: \${PORKBUN_API_SECRET_KEY}' "$REPO_ROOT/dankclaw/compose.yaml"
+}
+
+@test ".env.example carries the Porkbun secret under the module's name" {
+    grep -q 'PORKBUN_API_SECRET_KEY=' "$REPO_ROOT/dankclaw/.env.example"
+    ! grep -q '^PORKBUN_API_SECRET=' "$REPO_ROOT/dankclaw/.env.example"
+}
+
+@test "the porkbun caddy image build lives in the repo" {
+    local cf="$REPO_ROOT/dankclaw/caddy/Containerfile"
+    [ -f "$cf" ] || { echo "missing $cf"; return 1; }
+    grep -q 'xcaddy build' "$cf"
+    grep -q 'github.com/caddy-dns/porkbun' "$cf"
+}