cutover: Caddy DNS pushed to dtoro/caddy-conf (oikos/mcp/hermes → mac-mini)

DNS entries added:
  oikos.hubris.network  → 192.168.178.182:8090
  mcp.hubris.network    → 192.168.178.182:8090
  hermes.hubris.network → 192.168.178.182:8092

Auto-deploy will reload Caddy on LXC 121 within 2 minutes.
22/28 checklist items complete.

scripts/cutover-checklist.md

@@ -7,7 +7,7 @@ Status: [x] = done, [ ] = pending
 - [x] **Backup**: `pg_dump oikos > backups/pre-cutover-20260707.sql` (145K)
 - [x] **CI green**: pushed to main, `.gitea/workflows/ci.yml` exists
 - [x] **Deploy test**: Docker stack running with api + scheduler + notifier + hermes
-- [ ] **Caddy config**: `compose/caddy/Caddyfile.oikos` pending push to `dtoro/caddy-conf`
+- [x] **Caddy config**: `compose/caddy/Caddyfile.oikos` pushed to `dtoro/caddy-conf` (ed20908). Auto-deploys to caddy (121).
 - [x] **DNS**: `oikos.hubris.network` already resolves to 192.168.8.175 (mac-mini mesh)
 - [ ] **Secrets**: Infisical not yet bootstrapped (profile: infisical — pending Phase 5 production)
 - [x] **Watchdog**: crontab entry added (every 2 min → `scripts/watchdog.sh`)
@@ -17,7 +17,7 @@ Status: [x] = done, [ ] = pending
 - [x] **Stop apps/105 services**: homelab-mcp-deploy, secrets-issuance, secrets-issuance-deploy, oikos-console, oikos-console-deploy
 - [x] **Disable apps/105 services**: all 5 units disabled
 - [x] **Deploy to mac-mini**: Docker stack running (`docker compose --profile full up -d`)
-- [ ] **Caddy reload**: pending Caddyfile push to `dtoro/caddy-conf`
+- [x] **Caddy reload**: pushed to `dtoro/caddy-conf` — auto-deploy triggers on LXC 121.
 - [x] **DNS verify**: `oikos.hubris.network` → 192.168.8.175
 
 ## Post-cutover verification