refactor(caddy): retire decommissioned vhosts, rename chat->ai and jellyfin->jelly

DNS at Porkbun was renamed (chat->ai, jellyfin->jelly) and the qbittorrent,
*arr-stack, comfyui, hermes, dankclaw, and dankserver public records were
deleted. This brings the Caddy config in lockstep: ai/jelly vhosts now match
the new names; comfyui (guarded), hermes (guarded), and the *arr/qb vhosts
are removed as their DNS is gone. The legacy dankclaw/dankserver redirect
vhosts stay: Pi-hole still answers those names on the LAN.

dankclaw/Caddyfile

@@ -12,7 +12,7 @@
 # and handed to LAN clients by the SURFboard G36 router.
 #
 # Authentication chain (2026-08-29): the guarded vhosts (homepage, SearXNG,
-# Hermes, Prometheus, RomM, Copyparty) proxy EVERYTHING through the Anubis
+# Prometheus, RomM, Copyparty) proxy EVERYTHING through the Anubis
 # bot-challenge proxy first, then the whole request is proxied THROUGH
 # Authentik (2026.8 proxy-provider mode: this build serves no forward_auth
 # endpoint; the authentication flow runs inline — unauthenticated clients get
@@ -105,25 +105,11 @@ search.franksdank.cloud {
 	}
 }
 
-# --- ComfyUI (guarded: Anubis → Authentik; comfyui-proxy provider, internal_host caddy:8017) ---
-comfyui.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
-}
-
 # --- OpenWebUI (quadlet on slirp4netns; published 3005) ---
-chat.franksdank.cloud {
+ai.franksdank.cloud {
 	reverse_proxy 192.168.0.143:3005
 }
 
-# --- Hermes ---
-hermes.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
-}
-
 # --- Gitea (quadlet; published 3000) ---
 # Exempt by construction: Gitea has its own login, and git smart-HTTP
 # clients (git push/fetch over HTTPS) cannot solve JS challenges. The
@@ -217,34 +203,10 @@ files.franksdank.cloud {
 }
 
 # --- Jellyfin ---
-jellyfin.franksdank.cloud {
+jelly.franksdank.cloud {
 	reverse_proxy 192.168.0.235:8096
 }
 
-# --- *arr Stack ---
-radarr.franksdank.cloud {
-	reverse_proxy 192.168.0.235:7878
-}
-
-sonarr.franksdank.cloud {
-	reverse_proxy 192.168.0.235:8989
-}
-
-lidarr.franksdank.cloud {
-	reverse_proxy 192.168.0.235:8686
-}
-
-readarr.franksdank.cloud {
-	reverse_proxy 192.168.0.235:8787
-}
-
-prowlarr.franksdank.cloud {
-	reverse_proxy 192.168.0.235:9696
-}
-
-qbittorrent.franksdank.cloud {
-	reverse_proxy 192.168.0.235:8080
-}
 # --- Internal listener: auth decision layer ---------------------------------
 # Anubis dials http://caddy:8016 after verifying a client (TARGET in
 # dankclaw/anubis/quadlet/anubis.container). Host headers survive the hop.
@@ -293,15 +255,6 @@ http://:8017 {
 		reverse_proxy 192.168.0.143:8081
 	}
 
-	@hermes host hermes.franksdank.cloud
-	handle @hermes {
-		reverse_proxy 192.168.0.143:9119
-	}
-	@comfy host comfyui.franksdank.cloud
-	handle @comfy {
-		reverse_proxy comfyui:8188
-	}
-
 	@loki host loki.franksdank.cloud
 	handle @loki {
 		reverse_proxy loki:3100

dankclaw/pihole/addn-hosts

@@ -25,7 +25,7 @@
 192.168.0.143 books.franksdank.cloud
 192.168.0.143 romm.franksdank.cloud
 192.168.0.143 files.franksdank.cloud
-192.168.0.143 jellyfin.franksdank.cloud
+192.168.0.143 jelly.franksdank.cloud
 192.168.0.143 radarr.franksdank.cloud
 192.168.0.143 sonarr.franksdank.cloud
 192.168.0.143 lidarr.franksdank.cloud
@@ -36,7 +36,7 @@
 # --- AI / search / dev services (dankclaw, local) ---
 192.168.0.143 search.franksdank.cloud
 192.168.0.143 comfyui.franksdank.cloud
-192.168.0.143 chat.franksdank.cloud
+192.168.0.143 ai.franksdank.cloud
 192.168.0.143 hermes.franksdank.cloud
 192.168.0.143 gitea.franksdank.cloud
 192.168.0.143 grafana.franksdank.cloud