fix: basicauth double-prefix render; open-webui off slirp4netns

basicauth (2026-08-22 incident):
- the Caddyfile template carried its own $2a$14$ prefix and deploy.sh
  substituted the full hash (prefix included), rendering an invalid
  double-prefixed hash. Every basicauth vhost rejected every password
  with 401 and Caddy logged nothing.
- template is now a bare REPLACE_WITH_HASH token; tests pin the render
  contract (no prefix in template; rendered line is exactly 'dank <hash>').

open-webui (2026-08-22 incident):
- its slirp4netns helper process died, leaving the container running
  with only 'lo' in its netns: port 3005 accepted TCP and reset every
  request, so chat served empty responses for ~2 days, unlogged.
- move to a pinned bridge network (systemd-open-webui, 10.89.3.0/24,
  gw 10.89.3.1) — no per-container helper to die.
- LLM endpoint reached via the gateway (host.containers.internal is
  slirp-only): OPENAI_API_BASE_URL=http://10.89.3.1:52625.
- add a quadlet healthcheck: /health (app) + non-loopback interface
  (network liveness; the dead-tap state leaves only 'lo').
- deploy script now copies the .network file too.
- docs updated (OpenWebUI History section, Caddy basic-auth contract).

scripts/deploy-open-webui-quadlet.sh

@@ -4,7 +4,7 @@
 # open-webui is boot-persistent via Quadlet (see AGENTS.md). This script:
 #   1. Pushes main to origin
 #   2. Pulls the repo on the target
-#   3. Creates the data dir and copies the unit into ~/.config/containers/systemd/
+#   3. Creates the data dir and copies the unit + network into ~/.config/containers/systemd/
 #   4. daemon-reloads and starts open-webui (first run pulls the image)
 #
 # It is idempotent: it stops any running unit and removes any container with the
@@ -75,9 +75,10 @@ podman rm -f open-webui 2>/dev/null || true
 echo '  Creating the data dir (preserved across reruns)...'
 mkdir -p '${DATA_DIR}'
 
-echo '  Copying the quadlet unit into ~/.config/containers/systemd/ ...'
+echo '  Copying the quadlet unit + network into ~/.config/containers/systemd/ ...'
 mkdir -p ~/.config/containers/systemd
 cp ${QDIR}/open-webui.container ~/.config/containers/systemd/
+cp ${QDIR}/open-webui.network ~/.config/containers/systemd/
 
 echo '  daemon-reload (generates the unit)...'
 # Quadlet units are generator-managed: systemctl enable fails on them. The