caddy: www holds the homepage; naked domain redirects at the TLS edge

The proxy provider matches external_host exactly, so Host=www matched zero
providers and Authentik answered its error page while the naked domain
served the homepage. Flip the topology: www.franksdank.cloud is the one
guarded vhost carrying the homepage through Anubis -> Authentik -> :8017;
franksdank.cloud (plus legacy names and the bare-IP catch-all) 308-redirects
onto www before any challenge. Tests flipped to assert the new contract.

tests/caddyfile.bats

@@ -139,8 +139,10 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
     grep -q '{env.PORKBUN_API_SECRET_KEY}' "$CADDYFILE"
 }
 
-@test "the bare-IP catch-all redirects to the HTTPS homepage" {
-    grep -q 'redir https://franksdank.cloud/' "$CADDYFILE"
+@test "the bare-IP catch-all redirects onto the HTTPS homepage at www" {
+    local block
+    block=$(awk '/^:80 \{/,/^}/' "$CADDYFILE")
+    echo "$block" | grep -q 'redir https://www.franksdank.cloud/ 308'
 }
 
 @test "the caddy quadlet uses the locally built porkbun image without pulling" {