Caddyfile: serve the homepage via handle blocks (fix the /admin/ 401)

Caddy SORTS top-level directives, so a 'rewrite' runs before 'basicauth'.
The rewrite changed /admin/ to /admin.html, and the path-based auth matchers
then saw /admin.html (which matched the family 'not path /admin/*' block, not
the operator '/admin/*' block) — so the operator password was checked against
the family hash and 401'd.

Serve each page from its own 'handle' block (which preserves order, so the
auth is checked on the original path before any file rewrite):
- handle /admin* : operator (frank) only, try_files /admin.html
- handle @data   : shared data + assets, family (dank) OR operator (frank), so
  the admin page's fetches of services.json/status.json reuse the operator
  credential
- handle         : everything else (the user page), family (dank)

dankclaw/Caddyfile

@@ -46,17 +46,41 @@
 
 # --- Homepage (password protected) ---
 dankclaw.franksdank.cloud {
-	@admin path /admin/*
-	@user not path /admin/*
-	basicauth @user {
-		dank REPLACE_WITH_HASH
-	}
-	basicauth @admin {
-		frank REPLACE_WITH_ADMIN_HASH
-	}
-	rewrite @admin /admin.html
 	root * /srv/homepage
-	file_server
+
+	# Operator-only admin page (Q19). Auth is checked on the original path,
+	# before any rewrite, so the path matcher is reliable. Caddy sorts a
+	# top-level 'rewrite' before 'basicauth'; that would change the path and
+	# break the path-based auth matchers. 'handle' preserves order.
+	handle /admin* {
+		basicauth {
+			frank REPLACE_WITH_ADMIN_HASH
+		}
+		try_files /admin.html
+		file_server
+	}
+
+	# Shared data + assets: the family OR the operator, so both pages can load
+	# them (the browser reuses the page's credential for these fetches). A
+	# 'handle' inline matcher is a single token, so the multi-path match is a
+	# named matcher.
+	@data path /services.json /status.json /app.js /style.css /deployed.js
+	handle @data {
+		basicauth {
+			dank REPLACE_WITH_HASH
+			frank REPLACE_WITH_ADMIN_HASH
+		}
+		file_server
+	}
+
+	# Everything else (the user page): the family (Q18).
+	handle {
+		basicauth {
+			dank REPLACE_WITH_HASH
+		}
+		try_files /index.html
+		file_server
+	}
 }
 
 # --- Legacy name: the media host has no Caddy of its own anymore ---