Caddy: adopt dual-role snippet (PB api+admin on main host), relative PB file urls

- www host: /_* and /api/* proxy to pocketbase :8090, everything else to
  the TanStack app; redir /_ /_/ for the admin path
- cms host unchanged: redir / -> /_/
- migration: legacy per-host marker blocks are removed before the new
  combined block is installed
- cms.ts: PB file urls are now same-origin relative (/api/files/...) —
  browsers could never load the old 127.0.0.1:8090 urls; validated the
  rendered Caddyfile with caddy:2

ansible/roles/caddy/templates/snippet.j2

@@ -1,6 +1,20 @@
-{{ snippet.host }} {
-{% if snippet.pb_root | default(false) %}
-    redir / /_/
-{% endif %}
-    reverse_proxy {{ snippet.upstream }}
+{{ www_host }} {
+	# PocketBase Admin UI and REST API (files included)
+	redir /_ /_/
+	handle /_/* {
+		reverse_proxy {{ docker_container }}:{{ cms_port }}
+	}
+	handle /api/* {
+		reverse_proxy {{ docker_container }}:{{ cms_port }}
+	}
+
+	# TanStack Start frontend
+	handle {
+		reverse_proxy {{ docker_container }}:{{ www_port }}
+	}
+}
+
+{{ cms_host }} {
+	redir / /_/
+	reverse_proxy {{ docker_container }}:{{ cms_port }}
 }