Pi stack behind Nginx Proxy Manager: remove Caddy and cert-sync (D-120)

The server publishes 8080 on the Kvitt Pi's LAN interfaces and trusts X-Forwarded-For only from HA_HOST,
NPM's LAN address (an IPv4 literal, checked by install.sh). KVITT_PUBLIC_HOST (owner-chosen, not
icehack.asuscomm.com, which is NPM's proxy host for Home Assistant) builds KVITT_PUBLIC_URL. Only
fcm-service-account.json and rclone.conf are installed; install.sh removes the Caddyfile, the Home Assistant
SSH key, known_hosts and the certs and caddy_data volumes left by the earlier stack. Health checks: port 8080,
then through NPM. The cert-sync image leaves the workflow and build-images.sh.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

infra/pi/deploy.sh

@@ -5,7 +5,8 @@
 #     to every deploy); skipped when no database exists yet, or with --skip-backup (rollback while Drive is down)
 #  2. sets KVITT_TAG in /opt/kvitt/.env (the previous tag is kept in /opt/kvitt/previous-tag)
 #  3. docker compose pull, prints the pulled image digests and appends them to /opt/kvitt/deployed-digests (D-117),
-#     docker compose up -d, waits for server to be healthy, prints GET /health
+#     docker compose up -d, waits for server to be healthy, prints GET /health on port 8080 and through Nginx
+#     Proxy Manager (D-120; a failure through NPM is a warning, the deploy itself succeeded)
 # Rollback after a failed migration: /opt/kvitt/deploy.sh "$(cat /opt/kvitt/previous-tag)"; if a migration had
 # partially applied, restore the pre-deploy backup (infra/RESTORE.md).
 set -euo pipefail
@@ -55,5 +56,6 @@ if ! wait_healthy server 180; then
   die "server is not healthy on $tag. Roll back: $KVITT_DIR/deploy.sh ${current:-<previous tag>} --skip-backup"
 fi
 compose ps
-print_health || die "server is healthy but /health through Caddy failed (docker compose logs caddy cert-sync)"
+print_health || die "server is healthy but GET /health on port 8080 failed (docker compose logs server)"
+print_proxy_health || say "WARNING: /health through Nginx Proxy Manager failed: Kvitt is not reachable from outside (README, Troubleshooting)"
 say "Deployed $tag."