Caddy: PocketBase dashboard reachable at cms host root (redir / -> /_/)

- snippet generation moved to a j2 template; per-host pb_root flag
- cms.mozimo.in emits 'redir / /_/' before reverse_proxy (pattern from
  overlord's Caddyfile); other hosts unchanged
- snippets now update in place (blockinfile idempotency) instead of
  skipping when the desired block changed

ansible/roles/caddy/tasks/snippet.yaml

@@ -1,20 +1,12 @@
 ---
-- name: Build snippet block from variables
-  set_fact:
-    snippet_block: |
-      {{ snippet.host }} {
-          reverse_proxy {{ snippet.upstream }}
-      }
+- name: Build Caddy snippet block for {{ snippet.host }}
+  ansible.builtin.set_fact:
+    snippet_block: "{{ lookup('ansible.builtin.template', 'snippet.j2') }}"
 
-- name: Check if snippet already exists
-  set_fact:
-    snippet_present: "{{ snippet_block in caddyfile_content }}"
-
-- name: Add snippet if missing
+- name: Install snippet block for {{ snippet.host }}
   ansible.builtin.blockinfile:
     path: "{{ caddyfile_path }}"
     marker: "# {mark} Ansible managed Caddy snippet for {{ snippet.host }}"
     block: "{{ snippet_block }}"
-    create: yes
-  when: not snippet_present
+    insertafter: EOF
   notify: "Reload Caddy"