Caddy: adopt dual-role snippet (PB api+admin on main host), relative PB file urls

- www host: /_* and /api/* proxy to pocketbase :8090, everything else to
  the TanStack app; redir /_ /_/ for the admin path
- cms host unchanged: redir / -> /_/
- migration: legacy per-host marker blocks are removed before the new
  combined block is installed
- cms.ts: PB file urls are now same-origin relative (/api/files/...) —
  browsers could never load the old 127.0.0.1:8090 urls; validated the
  rendered Caddyfile with caddy:2

src/lib/cms.ts

@@ -63,9 +63,11 @@ async function pbList<T extends PbRecord>(
   }
 }
 
+// same-origin relative url: caddy routes /api/* to pocketbase on every
+// public host, so browsers can load cms-uploaded files directly
 const fileUrl = (r: PbRecord, filename: unknown) =>
   typeof filename === "string" && filename
-    ? `${PB_URL}/api/files/${r.collectionId}/${r.id}/${filename}`
+    ? `/api/files/${r.collectionId}/${r.id}/${filename}`
     : null;
 
 const str = (v: unknown) => (typeof v === "string" ? v.trim() : "");