Pi stack behind Nginx Proxy Manager: remove Caddy and cert-sync (D-120)

The server publishes 8080 on the Kvitt Pi's LAN interfaces and trusts X-Forwarded-For only from HA_HOST,
NPM's LAN address (an IPv4 literal, checked by install.sh). KVITT_PUBLIC_HOST (owner-chosen, not
icehack.asuscomm.com, which is NPM's proxy host for Home Assistant) builds KVITT_PUBLIC_URL. Only
fcm-service-account.json and rclone.conf are installed; install.sh removes the Caddyfile, the Home Assistant
SSH key, known_hosts and the certs and caddy_data volumes left by the earlier stack. Health checks: port 8080,
then through NPM. The cert-sync image leaves the workflow and build-images.sh.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

.gitea/workflows/build-images.yaml

@@ -2,7 +2,7 @@
 # example workflow and the Gitea Actions documentation; the first run is an owner step, infra/README.md).
 #
 # Runner: act_runner with the label `host` on the owner's Raspberry Pi (Alpine-based host, docker builds on the
-# Pi itself). Pushes three linux/arm64 images to the Gitea container registry of the same instance (gitea.lan,
+# Pi itself). Pushes two linux/arm64 images to the Gitea container registry of the same instance (gitea.lan,
 # plain HTTP), each tagged with the version vMAJOR.MINOR.PATCH and `latest`, then pushes the git tag of that version.
 # On the Kvitt Pi: /opt/kvitt/deploy.sh <version>.
 #
@@ -34,7 +34,6 @@ on:
   push:
     paths:
       - "server/**"
-      - "infra/cert-sync/**"
       - "infra/backup/**"
       - ".gitea/workflows/**"
   workflow_dispatch: {}
@@ -82,16 +81,6 @@ jobs:
       # --provenance=false on every build: one plain linux/arm64 manifest per tag, as Podman and infra/build-images.sh
       # push. Without it buildx pushes an index with an attestation entry (platform unknown/unknown), which the Gitea
       # package page lists as an extra platform; nothing here reads attestations.
-      - name: Build cert-sync image
-        run: |
-          docker buildx build \
-            --platform linux/arm64 \
-            --provenance=false \
-            -t "$REGISTRY/kvitt-cert-sync:$VERSION" \
-            -t "$REGISTRY/kvitt-cert-sync:latest" \
-            --metadata-file /tmp/kvitt-cert-sync.metadata.json \
-            ./infra/cert-sync \
-            --push
       - name: Build backup image
         run: |
           docker buildx build \
@@ -118,7 +107,7 @@ jobs:
       - name: Print image digests
         # The digests deploy.sh prints and records on the Kvitt Pi (/opt/kvitt/deployed-digests, D-117) must match.
         run: |
-          for name in cert-sync backup server; do
+          for name in backup server; do
             digest=$(sed -n 's/.*"containerimage.digest": *"\([^"]*\)".*/\1/p' "/tmp/kvitt-$name.metadata.json")
             echo "$REGISTRY/kvitt-$name:$VERSION ${digest:-unknown}"
             rm -f "/tmp/kvitt-$name.metadata.json"