caddy: keep admin on for hot reload; deploy.sh reloads after render

The Caddyfile had 'admin off', which disables Caddy's config file
watcher. Rendered Caddyfile changes never loaded until the container
was recreated, so the double-hash basicauth fix sat on disk unapplied
across deploys (2026-08-22). Admin binds to 127.0.0.1:2019 inside the
container and the port is unpublished, so nothing outside reaches it.

deploy.sh now issues an explicit 'caddy reload' (retry loop) after
'up -d', with the file watcher as backstop.

dankclaw/Caddyfile

@@ -23,7 +23,11 @@
 # resolves these names to 192.168.0.143.
 
 {
-	admin off
+	# Admin stays ON: it binds to 127.0.0.1:2019 inside the container and the
+	# port is not published, so nothing outside the container can reach it.
+	# It powers the config file watcher, so a rendered Caddyfile change
+	# hot-reloads without a container restart. 'admin off' once left a broken
+	# basicauth hash sitting on disk unapplied for hours (2026-08-22).
 	email admin@franksdank.cloud
 
 	# Solve ACME challenges for every site via Porkbun DNS (no port 80/443