fix: basicauth double-prefix render; open-webui off slirp4netns

basicauth (2026-08-22 incident):
- the Caddyfile template carried its own $2a$14$ prefix and deploy.sh
  substituted the full hash (prefix included), rendering an invalid
  double-prefixed hash. Every basicauth vhost rejected every password
  with 401 and Caddy logged nothing.
- template is now a bare REPLACE_WITH_HASH token; tests pin the render
  contract (no prefix in template; rendered line is exactly 'dank <hash>').

open-webui (2026-08-22 incident):
- its slirp4netns helper process died, leaving the container running
  with only 'lo' in its netns: port 3005 accepted TCP and reset every
  request, so chat served empty responses for ~2 days, unlogged.
- move to a pinned bridge network (systemd-open-webui, 10.89.3.0/24,
  gw 10.89.3.1) — no per-container helper to die.
- LLM endpoint reached via the gateway (host.containers.internal is
  slirp-only): OPENAI_API_BASE_URL=http://10.89.3.1:52625.
- add a quadlet healthcheck: /health (app) + non-loopback interface
  (network liveness; the dead-tap state leaves only 'lo').
- deploy script now copies the .network file too.
- docs updated (OpenWebUI History section, Caddy basic-auth contract).

dankclaw/Caddyfile

@@ -43,7 +43,7 @@
 # --- Homepage (password protected) ---
 dankclaw.franksdank.cloud {
 	basicauth {
-		dank $2a$14$REPLACE_WITH_HASH
+		dank REPLACE_WITH_HASH
 	}
 	root * /srv/homepage
 	file_server
@@ -61,7 +61,7 @@ dankserver.franksdank.cloud {
 # --- SearXNG (quadlet; behind the Gluetun tunnel, published 8081) ---
 search.franksdank.cloud {
 	basicauth {
-		dank $2a$14$REPLACE_WITH_HASH
+		dank REPLACE_WITH_HASH
 	}
 	reverse_proxy 192.168.0.143:8081
 }
@@ -74,7 +74,7 @@ comfyui.franksdank.cloud {
 # --- OpenWebUI (quadlet on slirp4netns; published 3005) ---
 chat.franksdank.cloud {
 	basicauth {
-		dank $2a$14$REPLACE_WITH_HASH
+		dank REPLACE_WITH_HASH
 	}
 	reverse_proxy 192.168.0.143:3005
 }
@@ -82,7 +82,7 @@ chat.franksdank.cloud {
 # --- Hermes ---
 hermes.franksdank.cloud {
 	basicauth {
-		dank $2a$14$REPLACE_WITH_HASH
+		dank REPLACE_WITH_HASH
 	}
 	reverse_proxy hermes:8090
 }
@@ -95,7 +95,7 @@ gitea.franksdank.cloud {
 # --- Grafana ---
 grafana.franksdank.cloud {
 	basicauth {
-		dank $2a$14$REPLACE_WITH_HASH
+		dank REPLACE_WITH_HASH
 	}
 	reverse_proxy grafana:3000
 }
@@ -103,7 +103,7 @@ grafana.franksdank.cloud {
 # --- Prometheus ---
 prometheus.franksdank.cloud {
 	basicauth {
-		dank $2a$14$REPLACE_WITH_HASH
+		dank REPLACE_WITH_HASH
 	}
 	reverse_proxy prometheus:9090
 }
@@ -138,7 +138,7 @@ books.franksdank.cloud {
 # --- RomM ---
 romm.franksdank.cloud {
 	basicauth {
-		dank $2a$14$REPLACE_WITH_HASH
+		dank REPLACE_WITH_HASH
 	}
 	reverse_proxy 192.168.0.235:8085
 }
@@ -146,7 +146,7 @@ romm.franksdank.cloud {
 # --- Copyparty ---
 files.franksdank.cloud {
 	basicauth {
-		dank $2a$14$REPLACE_WITH_HASH
+		dank REPLACE_WITH_HASH
 	}
 	reverse_proxy 192.168.0.235:3923
 }