caddy: www holds the homepage; naked domain redirects at the TLS edge

The proxy provider matches external_host exactly, so Host=www matched zero
providers and Authentik answered its error page while the naked domain
served the homepage. Flip the topology: www.franksdank.cloud is the one
guarded vhost carrying the homepage through Anubis -> Authentik -> :8017;
franksdank.cloud (plus legacy names and the bare-IP catch-all) 308-redirects
onto www before any challenge. Tests flipped to assert the new contract.

dankclaw/Caddyfile

@@ -55,24 +55,33 @@
 
 # --- Bare-IP access (health checks, convenience) ---
 :80 {
-	redir https://franksdank.cloud/ 302
+	redir https://www.franksdank.cloud/ 308
 }
 
 # --- Homepage (Anubis → Authentik SSO) ---
-franksdank.cloud www.franksdank.cloud {
+# www holds the homepage; the naked domain redirects onto it at the TLS edge.
+# A redirect needs no challenge, so unauthenticated naked traffic never enters
+# the auth chain. The proxy provider's external_host must match the host that
+# actually carries traffic (https://www.franksdank.cloud) or Authentik matches
+# zero providers and answers its error page instead.
+franksdank.cloud {
+	redir https://www.franksdank.cloud/ 308
+}
+
+www.franksdank.cloud {
 	reverse_proxy anubis:8923 {
 		header_up X-Real-Ip {remote_host}
 	}
 }
 
-# --- Legacy name: the old homepage name redirects to the naked domain ---
+# --- Legacy name: the old homepage name redirects straight onto www ---
 dankclaw.franksdank.cloud {
-	redir https://franksdank.cloud/ 302
+	redir https://www.franksdank.cloud/ 308
 }
 
 # --- Legacy name: the media host has no Caddy of its own anymore ---
 dankserver.franksdank.cloud {
-	redir https://franksdank.cloud/ 302
+	redir https://www.franksdank.cloud/ 308
 }
 
 # --- Authentik (SSO / OIDC provider) ---
@@ -234,7 +243,7 @@ qbittorrent.franksdank.cloud {
 # in place, authenticated traffic is forwarded back to http://:8017 and
 # routed straight to the app. Exempt vhosts never enter this block.
 http://:8016 {
-	@home host franksdank.cloud www.franksdank.cloud
+	@home host www.franksdank.cloud
 	handle @home {
 		reverse_proxy authentik-server:9000 {
 			header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
@@ -295,7 +304,7 @@ http://:8016 {
 # straight to its app. This is the end of the chain — nothing dials back
 # into Authentik from here, so the chain cannot loop.
 http://:8017 {
-	@home host franksdank.cloud www.franksdank.cloud
+	@home host www.franksdank.cloud
 	handle @home {
 		root * /srv/homepage
 		handle /admin* {