feat(portals): serve each portal with Caddy instead of nginx (refs #166)

nginx resolves a variable `proxy_pass` upstream itself, using only the `resolver`
directive and never the search domains in /etc/resolv.conf. That cost two
workarounds in one script: rewriting the resolver address for rootless podman
(Docker's 127.0.0.11 is wrong there), and injecting a full FQDN so the bare `bff`
name could resolve on Kubernetes at all.

Caddy dials its upstream per request through the system resolver, which reads
nameserver *and* search domains, so `reverse_proxy bff:8080` resolves on every
engine with no per-engine configuration — and it still starts before the BFF
exists and picks up its restarts. Both workarounds are deleted with the script.

Routing uses mutually-exclusive `handle` blocks, not a bare `try_files`: Caddy
sorts rewrites *before* reverse_proxy, so a top-level SPA fallback would rewrite
every API path to /index.html before the proxy saw it.

infra/docker-compose.local.yml

@@ -510,7 +510,7 @@ services:
     networks: [cg]
 
   # ── Portals (S-08/S-09/S-12) ──────────────────────────────────────────────
-  # nginx serves each Angular app and reverse-proxies its endpoint group to the BFF (same-origin).
+  # Caddy serves each Angular app and reverse-proxies its endpoint group to the BFF (same-origin).
   # The images bake config.json with the compose authority (keycloak:8080), which a HOST browser
   # can't resolve — so here we bind-mount a config.json pointing at the host-published localhost:8180
   # (matching KC_HOSTNAME). openbaar is anonymous and needs no config.
@@ -522,7 +522,7 @@ services:
     ports:
       - "8140:80"
     volumes:
-      - ./local-config/self-service.config.json:/usr/share/nginx/html/config.json:ro,z
+      - ./local-config/self-service.config.json:/usr/share/caddy/config.json:ro,z
     healthcheck:
       test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
       interval: 5s
@@ -562,7 +562,7 @@ services:
     ports:
       - "8142:80"
     volumes:
-      - ./local-config/behandel.config.json:/usr/share/nginx/html/config.json:ro,z
+      - ./local-config/behandel.config.json:/usr/share/caddy/config.json:ro,z
     healthcheck:
       test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
       interval: 5s