feat(portals): serve each portal with Caddy instead of nginx (refs #166)

nginx resolves a variable `proxy_pass` upstream itself, using only the `resolver`
directive and never the search domains in /etc/resolv.conf. That cost two
workarounds in one script: rewriting the resolver address for rootless podman
(Docker's 127.0.0.11 is wrong there), and injecting a full FQDN so the bare `bff`
name could resolve on Kubernetes at all.

Caddy dials its upstream per request through the system resolver, which reads
nameserver *and* search domains, so `reverse_proxy bff:8080` resolves on every
engine with no per-engine configuration — and it still starts before the BFF
exists and picks up its restarts. Both workarounds are deleted with the script.

Routing uses mutually-exclusive `handle` blocks, not a bare `try_files`: Caddy
sorts rewrites *before* reverse_proxy, so a top-level SPA fallback would rewrite
every API path to /index.html before the proxy saw it.

apps/behandel/src/app/app.config.ts

@@ -12,7 +12,7 @@ export interface RuntimeConfig {
 
 /**
  * Route prefixes whose requests carry the medewerker token. These MUST match the **relative** URLs
- * the api-client actually calls (same-origin via the nginx proxy) — the interceptor matches on
+ * the api-client actually calls (same-origin via the Caddy proxy) — the interceptor matches on
  * `req.url`, which stays relative, so an absolute origin would never match and the token would go
  * unattached. Only `/behandel/` is secured; the app calls no other endpoint group.
  */