caddy: www holds the homepage; naked domain redirects at the TLS edge

The proxy provider matches external_host exactly, so Host=www matched zero
providers and Authentik answered its error page while the naked domain
served the homepage. Flip the topology: www.franksdank.cloud is the one
guarded vhost carrying the homepage through Anubis -> Authentik -> :8017;
franksdank.cloud (plus legacy names and the bare-IP catch-all) 308-redirects
onto www before any challenge. Tests flipped to assert the new contract.

tests/authentik.bats

@@ -111,26 +111,36 @@ UNIT_DIR="$REPO_ROOT/dankclaw/authentik/quadlet"
     grep -qE '^http://:8017 \{' "$CADDYFILE"
 }
 
-# --- Homepage: moved to naked domain + www ---
+# --- Homepage: www holds the homepage; naked redirects onto it ---
 
-@test "the homepage vhost is the naked domain + www" {
-    grep -qE '^franksdank\.cloud[[:space:]]+www\.franksdank\.cloud[[:space:]]*\{' "$CADDYFILE"
+@test "the homepage vhost is www, guarded by Anubis" {
+    local block
+    block=$(awk '/^www\.franksdank\.cloud[[:space:]]*\{/,/^}/' "$CADDYFILE")
+    echo "$block" | grep -q 'reverse_proxy anubis:8923'
 }
 
-@test "dankclaw.franksdank.cloud redirects to the naked domain" {
+@test "the naked domain redirects to www at the TLS edge" {
+    local block
+    block=$(awk '/^franksdank\.cloud[[:space:]]*\{/,/^}/' "$CADDYFILE")
+    echo "$block" | grep -q 'redir https://www.franksdank.cloud/ 308'
+}
+
+@test "dankclaw.franksdank.cloud redirects straight onto www" {
     local block
     block=$(awk '/^dankclaw\.franksdank\.cloud/,/^}/' "$CADDYFILE")
-    echo "$block" | grep -q 'redir https://franksdank.cloud/'
+    echo "$block" | grep -q 'redir https://www.franksdank.cloud/ 308'
 }
 
-@test "dankserver.franksdank.cloud redirects to the naked domain" {
+@test "dankserver.franksdank.cloud redirects straight onto www" {
     local block
     block=$(awk '/^dankserver\.franksdank\.cloud/,/^}/' "$CADDYFILE")
-    echo "$block" | grep -q 'redir https://franksdank.cloud/'
+    echo "$block" | grep -q 'redir https://www.franksdank.cloud/ 308'
 }
 
-@test "the bare-IP catch-all redirects to the naked domain" {
-    grep -q 'redir https://franksdank.cloud/' "$CADDYFILE"
+@test "the bare-IP catch-all redirects onto www" {
+    local block
+    block=$(awk '/^:80 \{/,/^}/' "$CADDYFILE")
+    echo "$block" | grep -q 'redir https://www.franksdank.cloud/ 308'
 }
 
 # --- .env.example: authentik placeholders ---

tests/caddyfile.bats

@@ -139,8 +139,10 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
     grep -q '{env.PORKBUN_API_SECRET_KEY}' "$CADDYFILE"
 }
 
-@test "the bare-IP catch-all redirects to the HTTPS homepage" {
-    grep -q 'redir https://franksdank.cloud/' "$CADDYFILE"
+@test "the bare-IP catch-all redirects onto the HTTPS homepage at www" {
+    local block
+    block=$(awk '/^:80 \{/,/^}/' "$CADDYFILE")
+    echo "$block" | grep -q 'redir https://www.franksdank.cloud/ 308'
 }
 
 @test "the caddy quadlet uses the locally built porkbun image without pulling" {

tests/homepage_caddy.bats

@@ -1,10 +1,11 @@
 #!/usr/bin/env bats
 # Seam: the homepage site block in dankclaw/Caddyfile. Since the Anubis
-# rollout the naked domain + www are guarded vhosts: the public listener
-# proxies everything through Anubis (bot challenge), and the Authentik
-# forward_auth for SSO runs on Caddy's internal listener (http://:8016)
-# after Anubis has verified the client. caddy is not on the dev box, so the
-# tests assert the structure statically.
+# rollout, www holds the homepage as a guarded vhost (the naked domain
+# redirects onto it at the TLS edge): the public listener proxies www
+# through Anubis (bot challenge), and the Authentik SSO flow runs on
+# Caddy's internal listener (http://:8016) after Anubis has verified the
+# client. caddy is not on the dev box, so the tests assert the structure
+# statically.
 
 load helpers
 
@@ -33,11 +34,11 @@ setup() {
 }
 
 @test "the homepage vhost chains Anubis (public) before Authentik SSO (internal listener)" {
-    # Public listener: the naked domain proxies everything through Anubis.
+    # Public listener: www proxies everything through Anubis; the naked
+    # domain never enters the chain (it redirects at the TLS edge first).
     local block
-    block=$(awk '/^franksdank\.cloud[[:space:]]/,/^}/' "$CADDY")
+    block=$(awk '/^www\.franksdank\.cloud[[:space:]]*\{/,/^}/' "$CADDY")
     echo "$block" | grep -q 'reverse_proxy anubis:8923'
-    # The SSO check itself runs on the internal listener that Anubis
     # forwards accepted traffic to; Host survives the hop, so per-vhost
     # routing resumes there — guarded vhosts proxy the whole request
     # through Authentik, which forwards authenticated traffic back on the