caddy: www holds the homepage; naked domain redirects at the TLS edge

The proxy provider matches external_host exactly, so Host=www matched zero
providers and Authentik answered its error page while the naked domain
served the homepage. Flip the topology: www.franksdank.cloud is the one
guarded vhost carrying the homepage through Anubis -> Authentik -> :8017;
franksdank.cloud (plus legacy names and the bare-IP catch-all) 308-redirects
onto www before any challenge. Tests flipped to assert the new contract.

tests/homepage_caddy.bats

@@ -1,10 +1,11 @@
 #!/usr/bin/env bats
 # Seam: the homepage site block in dankclaw/Caddyfile. Since the Anubis
-# rollout the naked domain + www are guarded vhosts: the public listener
-# proxies everything through Anubis (bot challenge), and the Authentik
-# forward_auth for SSO runs on Caddy's internal listener (http://:8016)
-# after Anubis has verified the client. caddy is not on the dev box, so the
-# tests assert the structure statically.
+# rollout, www holds the homepage as a guarded vhost (the naked domain
+# redirects onto it at the TLS edge): the public listener proxies www
+# through Anubis (bot challenge), and the Authentik SSO flow runs on
+# Caddy's internal listener (http://:8016) after Anubis has verified the
+# client. caddy is not on the dev box, so the tests assert the structure
+# statically.
 
 load helpers
 
@@ -33,11 +34,11 @@ setup() {
 }
 
 @test "the homepage vhost chains Anubis (public) before Authentik SSO (internal listener)" {
-    # Public listener: the naked domain proxies everything through Anubis.
+    # Public listener: www proxies everything through Anubis; the naked
+    # domain never enters the chain (it redirects at the TLS edge first).
     local block
-    block=$(awk '/^franksdank\.cloud[[:space:]]/,/^}/' "$CADDY")
+    block=$(awk '/^www\.franksdank\.cloud[[:space:]]*\{/,/^}/' "$CADDY")
     echo "$block" | grep -q 'reverse_proxy anubis:8923'
-    # The SSO check itself runs on the internal listener that Anubis
     # forwards accepted traffic to; Host survives the hop, so per-vhost
     # routing resumes there — guarded vhosts proxy the whole request
     # through Authentik, which forwards authenticated traffic back on the