feat(portals): serve each portal with Caddy instead of nginx (refs #166)

nginx resolves a variable `proxy_pass` upstream itself, using only the `resolver`
directive and never the search domains in /etc/resolv.conf. That cost two
workarounds in one script: rewriting the resolver address for rootless podman
(Docker's 127.0.0.11 is wrong there), and injecting a full FQDN so the bare `bff`
name could resolve on Kubernetes at all.

Caddy dials its upstream per request through the system resolver, which reads
nameserver *and* search domains, so `reverse_proxy bff:8080` resolves on every
engine with no per-engine configuration — and it still starts before the BFF
exists and picks up its restarts. Both workarounds are deleted with the script.

Routing uses mutually-exclusive `handle` blocks, not a bare `try_files`: Caddy
sorts rewrites *before* reverse_proxy, so a top-level SPA fallback would rewrite
every API path to /index.html before the proxy saw it.

libs/auth/src/lib/digid-auth.providers.ts

@@ -15,7 +15,7 @@ export interface DigiadAuthOptions {
   redirectUrl: string;
   /**
    * Route prefixes whose requests get the bearer token attached. The api-client calls the BFF with
-   * **relative** URLs (same-origin via the nginx proxy), so these must be relative path prefixes
+   * **relative** URLs (same-origin via the Caddy proxy), so these must be relative path prefixes
    * (e.g. `/self-service/`) — angular-auth-oidc-client matches `req.url.startsWith(route)`, and a
    * relative `req.url` never starts with an absolute origin.
    */

libs/auth/src/lib/medewerker-auth.providers.ts

@@ -10,7 +10,7 @@ export interface MedewerkerAuthOptions {
   redirectUrl: string;
   /**
    * Route prefixes whose requests get the bearer token attached. The api-client calls the BFF with
-   * **relative** URLs (same-origin via the nginx proxy), so these must be relative path prefixes
+   * **relative** URLs (same-origin via the Caddy proxy), so these must be relative path prefixes
    * (e.g. `/behandel/`) — angular-auth-oidc-client matches `req.url.startsWith(route)`, and a
    * relative `req.url` never starts with an absolute origin.
    */