Caddy: adopt dual-role snippet (PB api+admin on main host), relative PB file urls

- www host: /_* and /api/* proxy to pocketbase :8090, everything else to
  the TanStack app; redir /_ /_/ for the admin path
- cms host unchanged: redir / -> /_/
- migration: legacy per-host marker blocks are removed before the new
  combined block is installed
- cms.ts: PB file urls are now same-origin relative (/api/files/...) —
  browsers could never load the old 127.0.0.1:8090 urls; validated the
  rendered Caddyfile with caddy:2

ansible/vars/default.yml

@@ -20,13 +20,7 @@ docker_network: "{{ title }}_net"
 docker_image: "{{ registry }}/{{ title }}:{{ image_tag | default(tag) }}"
 docker_container: "{{ title }}-staging"
 
-# hosts Caddy publishes on this box: web (SSR) + pocketbase (cms)
-caddy_hosts:
-  - host: "{{ www_host }}"
-    upstream: "{{ docker_container }}:{{ www_port }}"
-  - host: "{{ cms_host }}"
-    upstream: "{{ docker_container }}:{{ cms_port }}"
-    pb_root: true   # dashboard at / (Caddy redirs / -> /_/)
+# caddy publishes www (SSR + /api/* + /_/* -> pocketbase) and cms (admin)
 
 caddy_container: caddy
 caddyfile_path: /var/lib/caddy/conf/Caddyfile