caddy + pihole: make both boot-persistent and self-healing

Caddy left compose.yaml for a quadlet unit (caddy.service): joins
dankclaw_default for container-name upstreams, Pull=never for the local-only
image, Porkbun credentials via /home/dank/Containers/caddy/env written by
deploy from .env, bare-IP-catch-all health check. deploy_caddy installs,
enables, and starts the unit after retiring the bare container (state is in
host volumes).

Pi-hole: the repo now owns the sysctl drop-in
(dankclaw/pihole/sysctl/99-dnsmasq.conf, ip_unprivileged_port_start=53);
deploy_pihole installs it to /etc/sysctl.d/, stages conflicting later-sorted
drop-ins in the home trash, and applies 'sysctl --system' (the boot code
path). This fixes the 2026-08-26 crash loop (port-53 bind denied, restart
counter 1645) caused by a second drop-in resetting the value to 80.

Tests: new caddy_quadlet.bats seam; caddyfile/deployment_flow assertions
repointed from the removed compose service to the quadlet; pihole.bats pins
the sysctl drop-in and its deployment; test-changed.sh routes dankclaw/caddy/
and the pihole subtree to their seams. Docs: Caddy, Pi-hole, Dankclaw Stack,
work log.

tests/caddyfile.bats

@@ -76,13 +76,15 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
 }
 
 @test "compose no longer defines the quadlet-replaced services" {
-    # gitea, its postgres, and open-webui run as boot-persistent quadlets on
-    # dankclaw (see dankclaw/gitea/quadlet, dankclaw/open-webui/quadlet).
-    ! grep -qE '^\s+(gitea|postgres|openwebui):\s*$' "$REPO_ROOT/dankclaw/compose.yaml"
+    # gitea, its postgres, open-webui, and caddy run as boot-persistent
+    # quadlets on dankclaw (see dankclaw/gitea/quadlet,
+    # dankclaw/open-webui/quadlet, dankclaw/caddy/quadlet).
+    ! grep -qE '^\s+(gitea|postgres|openwebui|caddy):\s*$' "$REPO_ROOT/dankclaw/compose.yaml"
 }
 
-@test "the caddy service healthcheck probes the bare-IP catch-all" {
-    grep -q 'curl.*-sf.*http://localhost:80/' "$REPO_ROOT/dankclaw/compose.yaml"
+@test "the caddy quadlet healthcheck probes the bare-IP catch-all" {
+    grep -q 'HealthCmd=curl -sf -o /dev/null http://localhost:80/' \
+        "$REPO_ROOT/dankclaw/caddy/quadlet/caddy.container"
 }
 
 @test "plex vhosts proxy to PMS over a TLS upstream (PMS drops plain HTTP off-loopback)" {
@@ -138,13 +140,19 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
     grep -q 'redir https://franksdank.cloud/' "$CADDYFILE"
 }
 
-@test "the caddy service uses the locally built porkbun image" {
-    grep -q 'franksdank/caddy-porkbun' "$REPO_ROOT/dankclaw/compose.yaml"
+@test "the caddy quadlet uses the locally built porkbun image without pulling" {
+    # The image is built on-host from dankclaw/caddy/Containerfile; a boot
+    # must not stall on a registry that does not have it.
+    grep -q '^Image=franksdank/caddy-porkbun:latest$' \
+        "$REPO_ROOT/dankclaw/caddy/quadlet/caddy.container"
+    grep -q '^Pull=never$' "$REPO_ROOT/dankclaw/caddy/quadlet/caddy.container"
 }
 
-@test "the caddy service passes the Porkbun credentials from .env" {
-    grep -q 'PORKBUN_API_KEY: \${PORKBUN_API_KEY}' "$REPO_ROOT/dankclaw/compose.yaml"
-    grep -q 'PORKBUN_API_SECRET_KEY: \${PORKBUN_API_SECRET_KEY}' "$REPO_ROOT/dankclaw/compose.yaml"
+@test "the caddy quadlet reads the Porkbun credentials from its env file" {
+    grep -q '^EnvironmentFile=/home/dank/Containers/caddy/env$' \
+        "$REPO_ROOT/dankclaw/caddy/quadlet/caddy.container"
+    grep -q '^PORKBUN_API_KEY=changeme$' "$REPO_ROOT/dankclaw/caddy/env.example"
+    grep -q '^PORKBUN_API_SECRET_KEY=changeme$' "$REPO_ROOT/dankclaw/caddy/env.example"
 }
 
 @test ".env.example carries the Porkbun secret under the module's name" {