Pi-hole swap: quadlet + env + records + Caddy vhost (retires dnsmasq)

- dankclaw/pihole/: pihole.container (quadlet, slirp4netns, 53+8083),
  env.example (ServerIP/TZ/DNS1/DNS2/WEBPASSWORD placeholders), addn-hosts
  (moved from dankclaw/dnsmasq/, + pihole.franksdank.cloud record)
- Caddyfile: pihole.franksdank.cloud vhost (family basicauth -> 8083)
- scripts/deploy-pihole-quadlet.sh: idempotent quadlet installer
- tests/pihole.bats replaces tests/dnsmasq.bats (same record validation
  + cross-checks, new quadlet/env seams); retired files in .AGENTTRASH/

dankclaw/pihole/env.example

@@ -0,0 +1,18 @@
+# Pi-hole container environment (dankclaw).
+# Copy to /home/dank/Containers/pihole/env and fill real values.
+# The real env file is never committed (it holds the web UI password).
+
+# The host IP the container answers for (also shown in the web UI).
+ServerIP=192.168.0.143
+
+# Timezone for the web UI and logs.
+TZ=America/Los_Angeles
+
+# Pinned upstream resolvers. The slirp netns has no useful resolv.conf, so
+# pin them (mirrors the retired dnsmasq.conf server= lines).
+DNS1=1.1.1.1
+DNS2=1.0.0.1
+
+# Web UI password (the shared family password; the same credential as
+# CADDY_BASICAUTH_HASH in the host .env).
+WEBPASSWORD=changeme