caddy + pihole: make both boot-persistent and self-healing

Caddy left compose.yaml for a quadlet unit (caddy.service): joins
dankclaw_default for container-name upstreams, Pull=never for the local-only
image, Porkbun credentials via /home/dank/Containers/caddy/env written by
deploy from .env, bare-IP-catch-all health check. deploy_caddy installs,
enables, and starts the unit after retiring the bare container (state is in
host volumes).

Pi-hole: the repo now owns the sysctl drop-in
(dankclaw/pihole/sysctl/99-dnsmasq.conf, ip_unprivileged_port_start=53);
deploy_pihole installs it to /etc/sysctl.d/, stages conflicting later-sorted
drop-ins in the home trash, and applies 'sysctl --system' (the boot code
path). This fixes the 2026-08-26 crash loop (port-53 bind denied, restart
counter 1645) caused by a second drop-in resetting the value to 80.

Tests: new caddy_quadlet.bats seam; caddyfile/deployment_flow assertions
repointed from the removed compose service to the quadlet; pihole.bats pins
the sysctl drop-in and its deployment; test-changed.sh routes dankclaw/caddy/
and the pihole subtree to their seams. Docs: Caddy, Pi-hole, Dankclaw Stack,
work log.

tests/pihole.bats

@@ -48,6 +48,20 @@ HOSTS="$PIHOLE_DIR/addn-hosts"
     grep -qE '^Volume=/home/dank/Containers/pihole/addn-hosts:/etc/pihole/hosts/addn-hosts:ro$' "$QUADLET"
 }
 
+@test "the pihole sysctl drop-in pins the unprivileged port threshold to 53" {
+    # Rootless port 53 needs ip_unprivileged_port_start <= 53 at boot. The
+    # repo drop-in is the single source of truth; a later-sorted file that
+    # reset it to 80 took LAN DNS down after the 2026-08-26 reboot.
+    local f="$PIHOLE_DIR/sysctl/99-dnsmasq.conf"
+    [ -f "$f" ]
+    grep -q '^net.ipv4.ip_unprivileged_port_start=53$' "$f"
+}
+
+@test "deploy_pihole installs the sysctl drop-in and applies it at boot-path" {
+    grep -q 'dankclaw/pihole/sysctl/99-dnsmasq.conf' "$REPO_ROOT/scripts/deploy-remote.sh"
+    grep -q 'sysctl --system' "$REPO_ROOT/scripts/deploy-remote.sh"
+}
+
 @test "the pihole env example has placeholder values only" {
     [ -f "$ENV_EXAMPLE" ]
     grep -q '^WEBPASSWORD=changeme$' "$ENV_EXAMPLE"