Caddy: PocketBase dashboard reachable at cms host root (redir / -> /_/)

- snippet generation moved to a j2 template; per-host pb_root flag
- cms.mozimo.in emits 'redir / /_/' before reverse_proxy (pattern from
  overlord's Caddyfile); other hosts unchanged
- snippets now update in place (blockinfile idempotency) instead of
  skipping when the desired block changed

ansible/roles/caddy/templates/snippet.j2

@@ -0,0 +1,6 @@
+{{ snippet.host }} {
+{% if snippet.pb_root | default(false) %}
+    redir / /_/
+{% endif %}
+    reverse_proxy {{ snippet.upstream }}
+}