feat(nh3-svos): SVOS front door also on the LAN (10.100.50.43); internal DNS points svos names at it

configs/svos-front/Caddyfile

@@ -1,5 +1,7 @@
 # SVOS front door on nh3-svos (eshpfi configs/svos-front/), 2026-10-05. Prime: mesh-only, svos.phasefinal.com.
-# - Listens ONLY on the tailnet address (100.64.0.9:443). There is no LAN or internet listener and no :80 redirect server.
+# - Listens on the tailnet address (100.64.0.9:443) AND, since 2026-10-08 (Prime: "serve it on the LAN too"), on the
+#   LAN address (10.100.50.43:443), so non-mesh internal clients work; the internal AdGuards answer 10.100.50.43, the
+#   headscale MagicDNS records still answer 100.64.0.9. No internet listener and no :80 redirect server.
 # - Cert: Let's Encrypt via Cloudflare DNS-01 with a phasefinal.com-only token (env CF_API_TOKEN, /etc/caddy/env).
 # - Identity: HTTP Basic auth (Prime 2026-10-05: "Basic auth is fine, saved in browser is fine"; mesh-only because we
 #   don't host externally). One account, `Vuong` (Prime is how SVOS addresses him). argon2id hash in
@@ -28,7 +30,7 @@
 }
 
 https://svos.phasefinal.com:443 {
-	bind 100.64.0.9
+	bind 100.64.0.9 10.100.50.43
 	tls {
 		dns cloudflare {env.CF_API_TOKEN}
 		resolvers 1.1.1.1 8.8.8.8
@@ -130,7 +132,7 @@ https://svos.phasefinal.com:443 {
 }
 
 https://svos-terminal.phasefinal.com:443 {
-	bind 100.64.0.9
+	bind 100.64.0.9 10.100.50.43
 	tls {
 		dns cloudflare {env.CF_API_TOKEN}
 		resolvers 1.1.1.1 8.8.8.8
@@ -150,7 +152,7 @@ https://svos-terminal.phasefinal.com:443 {
 		# The kernel's signed calls come from the box itself (its source on the mesh address); anything else is refused.
 		@not_from_box {
 			path /verbs/* /health
-			not remote_ip 100.64.0.9 127.0.0.1
+			not remote_ip 100.64.0.9 10.100.50.43 127.0.0.1
 		}
 		handle @not_from_box {
 			respond 403