Caddyfile: serve the homepage via handle blocks (fix the /admin/ 401)

Caddy SORTS top-level directives, so a 'rewrite' runs before 'basicauth'.
The rewrite changed /admin/ to /admin.html, and the path-based auth matchers
then saw /admin.html (which matched the family 'not path /admin/*' block, not
the operator '/admin/*' block) — so the operator password was checked against
the family hash and 401'd.

Serve each page from its own 'handle' block (which preserves order, so the
auth is checked on the original path before any file rewrite):
- handle /admin* : operator (frank) only, try_files /admin.html
- handle @data   : shared data + assets, family (dank) OR operator (frank), so
  the admin page's fetches of services.json/status.json reuse the operator
  credential
- handle         : everything else (the user page), family (dank)

tests/homepage_caddy.bats

@@ -16,8 +16,12 @@ setup() {
 }
 
 @test "the admin basicauth is scoped to /admin/ (Q19)" {
-    grep -qE "@admin[[:space:]]+path[[:space:]]+/admin/" "$CADDY"
-    grep -qE "basicauth[[:space:]]+@admin" "$CADDY"
+    # The admin page is a 'handle /admin*' block with the operator (frank)
+    # credential. Caddy sorts a top-level 'rewrite' before 'basicauth', which
+    # would change the path and break the path-based auth matcher; 'handle'
+    # preserves order, so the auth is checked on the original path.
+    grep -qE "handle[[:space:]]+/admin\*" "$CADDY"
+    grep -qE "frank[[:space:]]+REPLACE_WITH_ADMIN_HASH" "$CADDY"
 }
 
 @test "the homepage serves /srv/homepage" {
@@ -25,9 +29,19 @@ setup() {
     grep -q "file_server" "$CADDY"
 }
 
-@test "the /admin/ path is rewritten to admin.html" {
-    # The matcher token follows the directive (rewrite @admin ...), per the
-    # Caddyfile matcher docs. A leading '@admin rewrite' is parsed as a
-    # one-liner matcher DEFINITION and re-defines @admin (invalid).
-    grep -qE "rewrite[[:space:]]+@admin[[:space:]]+/admin.html" "$CADDY"
+@test "the /admin/ page serves admin.html and / serves index.html" {
+    # Each page is served by its own 'handle' block via 'try_files' (which
+    # serves the named file without a top-level 'rewrite' that Caddy would
+    # sort before the basicauth).
+    grep -qE "try_files[[:space:]]+/admin.html" "$CADDY"
+    grep -qE "try_files[[:space:]]+/index.html" "$CADDY"
+}
+
+@test "the shared data + assets accept both the family and the operator" {
+    # The admin page (frank) and the user page (dank) both fetch the shared
+    # data (services.json, status.json) and assets. The browser reuses the
+    # page's credential for these, so the block must accept both users.
+    grep -qE "@data[[:space:]]+path[[:space:]]+/services\.json[[:space:]]+/status\.json" "$CADDY"
+    grep -qE "handle[[:space:]]+@data" "$CADDY"
+    grep -qE "dank[[:space:]]+REPLACE_WITH_HASH" "$CADDY"
 }