caddy: keep admin on for hot reload; deploy.sh reloads after render

The Caddyfile had 'admin off', which disables Caddy's config file
watcher. Rendered Caddyfile changes never loaded until the container
was recreated, so the double-hash basicauth fix sat on disk unapplied
across deploys (2026-08-22). Admin binds to 127.0.0.1:2019 inside the
container and the port is unpublished, so nothing outside reaches it.

deploy.sh now issues an explicit 'caddy reload' (retry loop) after
'up -d', with the file watcher as backstop.

tests/caddyfile.bats

@@ -49,6 +49,19 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
     grep -q 'REPLACE_WITH_HASH' "$CADDYFILE"
 }
 
+@test "the Caddyfile does not disable the admin endpoint (hot reload needs it)" {
+    # admin off disables Caddy's config file watcher: rendered Caddyfile
+    # changes are never loaded until the container is recreated, and the
+    # stale config fails silently (2026-08-22: basicauth stayed broken for
+    # hours across deploys). The admin API binds to 127.0.0.1:2019 inside
+    # the container and the port is not published, so it is not reachable
+    # from the LAN.
+    if grep -qE '^\s*admin\s+off' "$CADDYFILE"; then
+        echo "Caddyfile: 'admin off' disables hot reload of rendered config"
+        return 1
+    fi
+}
+
 @test "the basicauth placeholder is a bare token (no bcrypt prefix in the template)" {
     # Regression (2026-08-22): the template line was
     #   dank $2a$14$REPLACE_WITH_HASH

tests/deployment_flow.bats

@@ -37,6 +37,14 @@ load helpers
 # Regression: the Caddyfile render step in deploy.sh must survive a bcrypt
 # hash (which contains '/' characters). Reproduce the sed expression with a
 # slash-bearing hash and confirm the placeholder is replaced.
+@test "deploy.sh reloads Caddy after rendering (hot reload, not just container start)" {
+    # The caddy container often survives 'up -d' (a Caddyfile change is a
+    # bind-mount content change, not a container config change). Without an
+    # explicit reload, a rendered fix can sit on disk while Caddy serves the
+    # stale in-memory config.
+    grep -q 'caddy reload' "$REPO_ROOT/scripts/deploy.sh"
+}
+
 @test "deploy.sh Caddyfile render survives a slash-bearing bcrypt hash" {
     local hash='$2a$14$dndiQ9EaycJv0w3Gp2oAYO/xH6O9x2ZRhMLJdCxrgi9rMn1te9D/spy'
     local rendered