The Caddyfile is NOT in `ansible/roles/deploy/templates/`. Must find which role manages it and update there. All VPS changes must be in Ansible.
+
The Caddyfile lives on proxy-1 and is managed separately from this repo. During cutover, the proxy-1 agent needs one change: route `robot.wtf/auth/*` to port 8002 instead of 8003. Timing: after `robot-platform` is verified on 8002, before `robot-auth` is stopped.
