caddy: put loki.franksdank.cloud behind the Anubis+Authentik guard chain

Loki's public vhost had zero auth — any host that can resolve DNS could
query all logs via LogQL. The vhost now terminates at anubis:8923 and
authenticated traffic returns at the internal :8017 listener, where a new
@loki host handler routes to loki:3100. The outpost proxy provider
'loki-proxy' (external_host https://loki.franksdank.cloud/, internal_host
http://caddy:8017) was created before this deploy — provider-first
ordering so authenticated traffic never hits the outpost error page.
Ingestion is unaffected: Alloy pushes to loki:3100 on the compose network.

dankclaw/Caddyfile

@@ -147,9 +147,11 @@ prometheus.franksdank.cloud {
 	}
 }
 
-# --- Loki ---
+# --- Loki (guarded: Anubis → Authentik; loki-proxy provider, internal_host caddy:8017) ---
 loki.franksdank.cloud {
-	reverse_proxy loki:3100
+	reverse_proxy anubis:8923 {
+		header_up X-Real-Ip {remote_host}
+	}
 }
 
 # --- Pi-hole (quadlet on slirp4netns; published 8083) ---
@@ -295,6 +297,11 @@ http://:8017 {
 		reverse_proxy comfyui:8188
 	}
 
+	@loki host loki.franksdank.cloud
+	handle @loki {
+		reverse_proxy loki:3100
+	}
+
 	@prometheus host prometheus.franksdank.cloud
 	handle @prometheus {
 		reverse_proxy prometheus:9090