anubis: pin v1.27.0, fleet-wide cookie domain, persistent signing key

- Image bump v1.13.0 -> v1.27.0 (deploy_anubis pull+tag updated; JSON
  policy schema unchanged at this release).
- COOKIE_DOMAIN=franksdank.cloud: the challenge cookie now covers all
  guarded *.franksdank.cloud vhosts — solve the PoW once, not per-host.
- ED25519_PRIVATE_KEY_HEX via host env file (0600) with gitea-style
  [Service] EnvironmentFile expansion: restarts no longer invalidate
  everyone's solved challenges.
- Scratch-verified v1.27.0 before pinning: policy loads, challenge/DENY/
  ALLOW all behave, X-Real-Ip now mandatory (chain always sets it).

scripts/deploy-remote.sh

@@ -764,13 +764,13 @@ deploy_anubis() {
     # Anubis is the bot-challenge proxy in front of the guarded vhosts.
     # The image lives on ghcr.io; pull once, then the unit runs it from
     # local storage (Pull=never keeps boots off the registry).
-    if ! podman image exists ghcr.io/techarohq/anubis:v1.13.0; then
-        podman pull ghcr.io/techarohq/anubis:v1.13.0
+    if ! podman image exists ghcr.io/techarohq/anubis:v1.27.0; then
+        podman pull ghcr.io/techarohq/anubis:v1.27.0
     fi
     # The unit runs the localhost/ alias (see the unit file comment): this
     # host's podman quadlet path cannot resolve registry-prefixed refs from
     # local storage at create time. Tag first, then (re)create via deploy.
-    podman tag ghcr.io/techarohq/anubis:v1.13.0 localhost/techarohq/anubis:v1.13.0 2>/dev/null || true
+    podman tag ghcr.io/techarohq/anubis:v1.27.0 localhost/techarohq/anubis:v1.27.0 2>/dev/null || true
     cp "dankclaw/anubis/quadlet/anubis.container" "$quadlet_unit_dir/"
     systemctl --user daemon-reload
     # No enable: generated units cannot be enabled on this host (v1 quadlet