feat: initialize serverAppConfigs with podman stacks for Dankserver and Dankclaw

- Dankserver stack: RomM, Copyparty, Calibre-Web, node-exporter
- Dankclaw stack: Gluetun VPN (SearXNG tunnel), SearXNG+Valkey, ComfyUI
  (CPU backend), OpenWebUI, Hermes, Gitea+Postgres (migrated), Caddy
  reverse proxy, Grafana+Prometheus+Loki+Alloy observability
- Caddyfiles with .local hostname convention and basicauth homepage
- bind-mount storage policy, no named volumes
- deploy.sh mirroring vllmScripts git workflow (push -> pull -> restart -> health)
- docs/ Obsidian vault: per-service docs from frank-default-small research
  subagents (promtail EOL -> Alloy; gitea SECRET_KEY preservation; ComfyUI --cpu)
- bats test suite at 6 seams — 22 tests green

docs/Infrastructure/Caddy.md

@@ -0,0 +1,71 @@
+# Caddy
+
+Caddy is the reverse proxy for both hosts. It terminates TLS, routes hostnames to containers, and protects the homepage with HTTP basic auth.
+
+**Hosts:** Dankserver + Dankclaw — **Docs:** https://caddyserver.com/docs
+
+## Facts (from live inventory + knowledge base)
+
+| Item | Value |
+|------|-------|
+| Image | `docker.io/library/caddy:latest` |
+| Config | `/etc/caddy/Caddyfile` (bind mount) |
+| Data | `/root/.local/share/caddy` (certs, ACME state) |
+| Ports | 80, 443 |
+| Existing on Dankserver | systemd `caddy` service (native), config at `/etc/caddy/Caddyfile` — being migrated into this repo |
+
+## Existing Dankserver Caddyfile (live, to migrate)
+
+The live Caddyfile proxies:
+- `plex.franksdank.casa` / `plex.franksdank.cloud` / `plex.dankserver.local` → `localhost:32400` (Plex)
+- `books.franksdank.cloud` → `localhost:8083` (Calibre-Web)
+- `llms.franksdank.cloud` / `llms.dankserver.local` → `localhost:3000` (OpenWebUI — being moved to Dankclaw)
+- `search.dankserver.local` → `localhost:8081` (SearXNG — being moved to Dankclaw)
+
+## Hostname Convention
+
+Every service gets a `.dankserver.local` or `.dankclaw.local` hostname so no one has to remember port numbers:
+
+```
+romm.dankserver.local
+books.dankserver.local
+files.dankserver.local
+search.dankclaw.local
+chat.dankclaw.local
+gitea.dankclaw.local
+comfyui.dankclaw.local
+grafana.dankclaw.local
+prometheus.dankclaw.local
+```
+
+## Basic Auth
+
+Generate a bcrypt hash with `caddy hash-password`, then:
+
+```
+chat.dankclaw.local {
+    basicauth {
+        dank $2a$14$xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+    }
+    reverse_proxy localhost:3000
+}
+```
+
+The homepage uses basic auth too; see [[Homepage]].
+
+## Homepage
+
+A static page lists all services with live status (up/down) and a short description plus a link to each service's documentation. Served by Caddy with `file_server` and protected by basic auth.
+
+## Gotchas
+
+- Caddy auto-provisions Let's Encrypt certs for public domains; `.local` names stay internal (no external DNS).
+- Validate before reload: `caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile`.
+- Certificates live in the caddy data volume; back it up with the stack.
+
+## See Also
+
+- [[Dankserver Stack]]
+- [[Dankclaw Stack]]
+- [[Homepage]]
+- Knowledge base: [[Gitea Architecture]] (the existing caddy chain on Dankclaw)