fix: remaining DHCP drifts + improve validation script

- Fixed apps LXC 105: /etc/network/interfaces was still 'iface eth0 inet
  dhcp' -> changed to static 192.168.8.205/24, killed dhclient, applied
- Fixed mule-images LXC 120: DHCP client had overridden static .136 with
  DHCP lease .108 -> killed dhclient, restored .136
- Fixed sophia docs: inventory said .157, actual Proxmox config is .109
- Updated check-caddy-backends.sh: uses curl with connect-timeout for
  reliable TCP checks, distinguishes 'port open / no HTTP' from 'unreachable'

hosts/sophia.yaml

@@ -7,7 +7,7 @@ os: linux
 role: workshop
 host: hubris
 pve_id: 119
-lan_ip: 192.168.8.157
+lan_ip: 192.168.8.109
 mesh:
   tailscale:
     fqdn: sophia

inventory.yaml

@@ -221,7 +221,7 @@ hosts:
     host: hubris
     os: linux
     role: workshop
-    lan_ip: 192.168.8.157
+    lan_ip: 192.168.8.109
     mesh:
       tailscale:
         fqdn: sophia

scripts/check-caddy-backends.sh

@@ -2,6 +2,7 @@
 # check-caddy-backends.sh — validate all Caddy reverse_proxy targets are reachable
 # Run this on hubris (192.168.8.77) or any host on the homelab LAN.
 # Returns non-zero if any backend is unreachable.
+# Uses curl with a short timeout for reliable TCP checks.
 set -o pipefail
 
 CADDY_HOST="192.168.8.175"
@@ -24,9 +25,11 @@ FAILED=0
 while read -r target; do
   [ -z "$target" ] && continue
   TOTAL=$((TOTAL + 1))
-  ip_port=(${target//:/ })
+  # Use curl with 3s connect timeout for reliable TCP check
-  if timeout 3 bash -c "echo >/dev/tcp/${ip_port[0]}/${ip_port[1]}" 2>/dev/null; then
+  if timeout 3 curl -s -o /dev/null --connect-timeout 2 "$target" 2>/dev/null; then
     echo "  ✅ $target"
+  elif timeout 2 bash -c "echo >/dev/tcp/${target/:/\/}" 2>/dev/null; then
+    echo "  ⚠️ $target — port open, no HTTP response"
   else
     echo "  ❌ $target — unreachable"
     FAILED=$((FAILED + 1))