Caddy: PocketBase dashboard reachable at cms host root (redir / -> /_/)

- snippet generation moved to a j2 template; per-host pb_root flag
- cms.mozimo.in emits 'redir / /_/' before reverse_proxy (pattern from
  overlord's Caddyfile); other hosts unchanged
- snippets now update in place (blockinfile idempotency) instead of
  skipping when the desired block changed

ansible/roles/caddy/tasks/snippet.yaml

@@ -1,20 +1,12 @@
 ---
-- name: Build snippet block from variables
+- name: Build Caddy snippet block for {{ snippet.host }}
-  set_fact:
+  ansible.builtin.set_fact:
-    snippet_block: |
+    snippet_block: "{{ lookup('ansible.builtin.template', 'snippet.j2') }}"
-      {{ snippet.host }} {
-          reverse_proxy {{ snippet.upstream }}
-      }
 
-- name: Check if snippet already exists
+- name: Install snippet block for {{ snippet.host }}
-  set_fact:
-    snippet_present: "{{ snippet_block in caddyfile_content }}"
-
-- name: Add snippet if missing
   ansible.builtin.blockinfile:
     path: "{{ caddyfile_path }}"
     marker: "# {mark} Ansible managed Caddy snippet for {{ snippet.host }}"
     block: "{{ snippet_block }}"
-    create: yes
+    insertafter: EOF
-  when: not snippet_present
   notify: "Reload Caddy"

ansible/roles/caddy/templates/snippet.j2

@@ -0,0 +1,6 @@
+{{ snippet.host }} {
+{% if snippet.pb_root | default(false) %}
+    redir / /_/
+{% endif %}
+    reverse_proxy {{ snippet.upstream }}
+}