refactor(caddy): split vhosts into conf.d snippets (core/static/mirror)

Base Caddyfile now imports conf.d/*.caddy. Snippets are mounted selectively
so the stack runs with or without the static site / air-gap mirror:
  00-core   auth + packwiz (always)
  10-static apex landing + launcher downloads
  20-mirror air-gap upstream hosts (tls internal)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

caddy/conf.d/10-static.caddy

@@ -0,0 +1,14 @@
+# Static toggle — apex landing page + launcher downloads.
+# Mounted only when the stack runs with static files (build-stack.sh up static|full).
+http://{$BASE_DOMAIN} {
+	# Launcher downloads are a sibling mount (/srv/launcher), not nested under
+	# the read-only /srv/www. handle_path strips the /launcher prefix.
+	handle_path /launcher/* {
+		root * /srv/launcher
+		file_server browse
+	}
+	handle {
+		root * /srv/www
+		file_server
+	}
+}