fix: gitea DHCP drift + add caddy backend validation script

scripts/check-caddy-backends.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+# check-caddy-backends.sh — validate all Caddy reverse_proxy targets are reachable
+# Run this on hubris (192.168.8.77) or any host on the homelab LAN.
+# Returns non-zero if any backend is unreachable.
+set -o pipefail
+
+CADDY_HOST="192.168.8.175"
+
+echo "=== Caddy backend connectivity check ==="
+echo "Date: $(date)"
+echo ""
+
+TMPFILE=$(mktemp /tmp/caddy-checks.XXXXXX)
+trap "rm -f $TMPFILE" EXIT
+
+# Extract unique IP:port targets from Caddyfile
+ssh root@"$CADDY_HOST" "grep reverse_proxy /etc/caddy/Caddyfile \
+  | grep -oP '\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d+' \
+  | sort -u" > "$TMPFILE"
+
+TOTAL=0
+FAILED=0
+
+while read -r target; do
+  [ -z "$target" ] && continue
+  TOTAL=$((TOTAL + 1))
+  ip_port=(${target//:/ })
+  if timeout 3 bash -c "echo >/dev/tcp/${ip_port[0]}/${ip_port[1]}" 2>/dev/null; then
+    echo "  ✅ $target"
+  else
+    echo "  ❌ $target — unreachable"
+    FAILED=$((FAILED + 1))
+  fi
+done < "$TMPFILE"
+
+echo ""
+echo "Checked $TOTAL targets, $FAILED failures"
+exit $FAILED