Migrate Gitea proxy to canonical Caddy

tests/caddyfile.bats

@@ -85,6 +85,15 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
     grep -q 'curl.*-sf.*http://localhost:80/' "$REPO_ROOT/dankclaw/compose.yaml"
 }
 
+@test "Gitea has no standalone reverse-proxy Quadlet" {
+    [ ! -e "$REPO_ROOT/dankclaw/gitea/quadlet/gitea-caddy.container" ]
+}
+
+@test "the canonical Caddy owns the Gitea route" {
+    grep -qF 'gitea.franksdank.cloud {' "$CADDYFILE"
+    grep -qF 'reverse_proxy 192.168.0.143:3000' "$CADDYFILE"
+}
+
 # --- Phase 2: real TLS via DNS-01 (Porkbun wildcard cert) ---
 
 @test "all vhosts use TLS except the legacy .casa name" {

tests/deployment_flow.bats

@@ -47,6 +47,13 @@ load helpers
     ! grep -qE 'podman-compose.*(up|restart).*\$\(' "$REPO_ROOT/scripts/deploy-remote.sh"
 }
 
+@test "Caddy migration retires the standalone Gitea proxy" {
+    grep -q 'retire_legacy_gitea_caddy' "$REPO_ROOT/scripts/deploy-remote.sh"
+    grep -q 'systemctl --user stop gitea-caddy.service' "$REPO_ROOT/scripts/deploy-remote.sh"
+    grep -q 'systemctl --user disable gitea-caddy.service' "$REPO_ROOT/scripts/deploy-remote.sh"
+    ! grep -q 'deploy_gitea_unit gitea-caddy' "$REPO_ROOT/scripts/deploy-remote.sh"
+}
+
 @test "remote runner has separate handlers for both inference services" {
     grep -q 'deploy_llm_large' "$REPO_ROOT/scripts/deploy-remote.sh"
     grep -q 'deploy_llm_small' "$REPO_ROOT/scripts/deploy-remote.sh"

tests/deployment_scoping.bats

@@ -97,6 +97,38 @@ REMOTE_DEPLOY="$REPO_ROOT/scripts/deploy-remote.sh"
     [ "$output" = $'gluetun\nsearxng' ]
 }
 
+@test "retiring the standalone Gitea proxy deploys the canonical Caddy" {
+    run python3 "$PLANNER" --target dankclaw --paths \
+        dankclaw/gitea/quadlet/gitea-caddy.container
+    [ "$status" -eq 0 ]
+    [ "$output" = "caddy" ]
+}
+
+@test "Gitea network changes exclude the retired standalone proxy" {
+    run python3 "$PLANNER" --target dankclaw --paths \
+        dankclaw/gitea/quadlet/gitea.network
+    [ "$status" -eq 0 ]
+    [ "$output" = $'gitea-postgres\ngitea-server' ]
+}
+
+@test "remote Caddy deployment no longer blocks on the retired Gitea proxy" {
+    ! grep -q 'refusing to replace it with caddy' "$REMOTE_DEPLOY"
+    ! grep -q 'podman container exists gitea-caddy &&' "$REMOTE_DEPLOY"
+}
+
+@test "remote Caddy deployment retires the installed Gitea proxy" {
+    grep -q 'retire_legacy_gitea_caddy' "$REMOTE_DEPLOY"
+    grep -q 'systemctl --user stop gitea-caddy.service' "$REMOTE_DEPLOY"
+    grep -q 'systemctl --user disable gitea-caddy.service' "$REMOTE_DEPLOY"
+    grep -q 'gitea-caddy.container' "$REMOTE_DEPLOY"
+    grep -q 'HOME/.AGENTTRASH' "$REMOTE_DEPLOY"
+}
+
+@test "remote deployment inventory no longer accepts gitea-caddy as a service" {
+    ! grep -qE 'dankclaw:gitea-caddy|gitea-caddy\) deploy' "$REPO_ROOT/scripts/deploy.sh" "$REPO_ROOT/scripts/deploy-remote.sh"
+    ! grep -q '"gitea-caddy"' "$REPO_ROOT/scripts/deploy-plan.py"
+}
+
 @test "remote deployer carries per-service deployment state" {
     [ -x "$REMOTE_DEPLOY" ]
     grep -q 'deploy-state' "$REMOTE_DEPLOY"