caddy: www holds the homepage; naked domain redirects at the TLS edge

The proxy provider matches external_host exactly, so Host=www matched zero
providers and Authentik answered its error page while the naked domain
served the homepage. Flip the topology: www.franksdank.cloud is the one
guarded vhost carrying the homepage through Anubis -> Authentik -> :8017;
franksdank.cloud (plus legacy names and the bare-IP catch-all) 308-redirects
onto www before any challenge. Tests flipped to assert the new contract.

tests/authentik.bats

@@ -111,26 +111,36 @@ UNIT_DIR="$REPO_ROOT/dankclaw/authentik/quadlet"
     grep -qE '^http://:8017 \{' "$CADDYFILE"
 }
 
-# --- Homepage: moved to naked domain + www ---
+# --- Homepage: www holds the homepage; naked redirects onto it ---
 
-@test "the homepage vhost is the naked domain + www" {
-    grep -qE '^franksdank\.cloud[[:space:]]+www\.franksdank\.cloud[[:space:]]*\{' "$CADDYFILE"
+@test "the homepage vhost is www, guarded by Anubis" {
+    local block
+    block=$(awk '/^www\.franksdank\.cloud[[:space:]]*\{/,/^}/' "$CADDYFILE")
+    echo "$block" | grep -q 'reverse_proxy anubis:8923'
 }
 
-@test "dankclaw.franksdank.cloud redirects to the naked domain" {
+@test "the naked domain redirects to www at the TLS edge" {
+    local block
+    block=$(awk '/^franksdank\.cloud[[:space:]]*\{/,/^}/' "$CADDYFILE")
+    echo "$block" | grep -q 'redir https://www.franksdank.cloud/ 308'
+}
+
+@test "dankclaw.franksdank.cloud redirects straight onto www" {
     local block
     block=$(awk '/^dankclaw\.franksdank\.cloud/,/^}/' "$CADDYFILE")
-    echo "$block" | grep -q 'redir https://franksdank.cloud/'
+    echo "$block" | grep -q 'redir https://www.franksdank.cloud/ 308'
 }
 
-@test "dankserver.franksdank.cloud redirects to the naked domain" {
+@test "dankserver.franksdank.cloud redirects straight onto www" {
     local block
     block=$(awk '/^dankserver\.franksdank\.cloud/,/^}/' "$CADDYFILE")
-    echo "$block" | grep -q 'redir https://franksdank.cloud/'
+    echo "$block" | grep -q 'redir https://www.franksdank.cloud/ 308'
 }
 
-@test "the bare-IP catch-all redirects to the naked domain" {
-    grep -q 'redir https://franksdank.cloud/' "$CADDYFILE"
+@test "the bare-IP catch-all redirects onto www" {
+    local block
+    block=$(awk '/^:80 \{/,/^}/' "$CADDYFILE")
+    echo "$block" | grep -q 'redir https://www.franksdank.cloud/ 308'
 }
 
 # --- .env.example: authentik placeholders ---