Pi-hole swap: quadlet + env + records + Caddy vhost (retires dnsmasq)

- dankclaw/pihole/: pihole.container (quadlet, slirp4netns, 53+8083),
  env.example (ServerIP/TZ/DNS1/DNS2/WEBPASSWORD placeholders), addn-hosts
  (moved from dankclaw/dnsmasq/, + pihole.franksdank.cloud record)
- Caddyfile: pihole.franksdank.cloud vhost (family basicauth -> 8083)
- scripts/deploy-pihole-quadlet.sh: idempotent quadlet installer
- tests/pihole.bats replaces tests/dnsmasq.bats (same record validation
  + cross-checks, new quadlet/env seams); retired files in .AGENTTRASH/

dankclaw/Caddyfile

@@ -7,8 +7,8 @@
 #   - dankserver services (192.168.0.235): by published LAN port
 #
 # Naming: flat franksdank.cloud scheme (see docs/Infrastructure/LAN-DNS.md).
-# DNS for these names is served by the dnsmasq quadlet on this host
-# (dankclaw/dnsmasq/addn-hosts — every name resolves to 192.168.0.143)
+# DNS for these names is served by the Pi-hole quadlet on this host
+# (dankclaw/pihole/addn-hosts — every name resolves to 192.168.0.143)
 # and handed to LAN clients by the SURFboard G36 router.
 #
 # The basicauth hash below is a placeholder. deploy.sh renders the real
@@ -147,6 +147,14 @@ loki.franksdank.cloud {
 	reverse_proxy loki:3100
 }
 
+# --- Pi-hole (quadlet on slirp4netns; published 8083) ---
+pihole.franksdank.cloud {
+	basicauth {
+		dankuser REPLACE_WITH_HASH
+	}
+	reverse_proxy 192.168.0.143:8083
+}
+
 # ═══════════════════════════════════════════════════════════════
 # Services on dankserver (192.168.0.235) — published LAN ports
 # ═══════════════════════════════════════════════════════════════