caddy + pihole: make both boot-persistent and self-healing

Caddy left compose.yaml for a quadlet unit (caddy.service): joins
dankclaw_default for container-name upstreams, Pull=never for the local-only
image, Porkbun credentials via /home/dank/Containers/caddy/env written by
deploy from .env, bare-IP-catch-all health check. deploy_caddy installs,
enables, and starts the unit after retiring the bare container (state is in
host volumes).

Pi-hole: the repo now owns the sysctl drop-in
(dankclaw/pihole/sysctl/99-dnsmasq.conf, ip_unprivileged_port_start=53);
deploy_pihole installs it to /etc/sysctl.d/, stages conflicting later-sorted
drop-ins in the home trash, and applies 'sysctl --system' (the boot code
path). This fixes the 2026-08-26 crash loop (port-53 bind denied, restart
counter 1645) caused by a second drop-in resetting the value to 80.

Tests: new caddy_quadlet.bats seam; caddyfile/deployment_flow assertions
repointed from the removed compose service to the quadlet; pihole.bats pins
the sysctl drop-in and its deployment; test-changed.sh routes dankclaw/caddy/
and the pihole subtree to their seams. Docs: Caddy, Pi-hole, Dankclaw Stack,
work log.

dankclaw/caddy/env.example

@@ -0,0 +1,7 @@
+# Caddy environment (placeholders only). The deploy writes the live file at
+# /home/dank/Containers/caddy/env from the checkout's .env; the quadlet reads
+# it via EnvironmentFile. Consumed by the Caddyfile's acme_dns block
+# (DNS-01 wildcard cert issuance). PORKBUN_API_SECRET_KEY is the name the
+# caddy-dns/porkbun module expects.
+PORKBUN_API_KEY=changeme
+PORKBUN_API_SECRET_KEY=changeme