ci: validate the production Caddyfile inside the built image (#26)

The caddy-validate step added for #26 (and merged to main via #29) used a
`-v "$PWD":/workspace` bind mount, which does not propagate to the sibling
Docker daemon in the Gitea act runner — the container saw an empty dir and
every PR failed with "open Caddyfile: no such file or directory".

Validate instead inside the freshly built image, where the production
Caddyfile lives at /etc/caddy/Caddyfile: no bind mount, and it checks the
exact file that ships. Caddyfile.test keeps being covered by the homepage
smoke test (its container must serve 200).

Closes #26

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/test.yml

@@ -11,21 +11,25 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      # The test image below swaps in Caddyfile.test, so the production
-      # Caddyfile is otherwise never exercised by CI — an invalid config then
-      # only surfaces when the deploy health-gate fails, after the broken
-      # container already replaced the healthy one (issue #20/#26). Validate
-      # both files up front so a parse error fails the PR check in seconds.
-      - name: Validate Caddyfiles
-        run: |
-          docker run --rm -v "$PWD":/workspace -w /workspace caddy:2-alpine \
-            caddy validate --config Caddyfile --adapter caddyfile
-          docker run --rm -v "$PWD":/workspace -w /workspace caddy:2-alpine \
-            caddy validate --config Caddyfile.test --adapter caddyfile
-
       - name: Build Docker image
         run: docker build -t learning-platform .
 
+      # The production Caddyfile is otherwise never exercised by CI — the test
+      # image below swaps in Caddyfile.test — so a parse error only surfaced at
+      # deploy time, after the broken container had already replaced the healthy
+      # one (issue #20/#26). Validate it here, inside the freshly built image
+      # where it lives at /etc/caddy/Caddyfile. This runs caddy against the
+      # exact file that ships and needs no bind mount — a `-v "$PWD":...` mount
+      # does not propagate to the sibling Docker daemon in the Gitea runner,
+      # which is why the earlier mount-based step failed with
+      # "open Caddyfile: no such file or directory" (#26).
+      # Caddyfile.test needs no separate check: the "Test homepage" step below
+      # runs the test image and fails if that config can't serve.
+      - name: Validate production Caddyfile
+        run: |
+          docker run --rm --entrypoint caddy learning-platform \
+            validate --adapter caddyfile --config /etc/caddy/Caddyfile
+
       - name: Build test image
         run: |
           cat > Dockerfile.test <<'EOF'