refactor(caddy): modularise deployment init

Split the monolithic init-caddy.sh into four ordered, idempotent
setup scripts for the Caddy deployment environment:

- install-base-deps: install required apt packages
- install-aws-cli: bootstrap AWS CLI v2
- install-caddy: fetch binary, create caddy:caddy, register systemd unit
- prepare-caddy-cicd: create bot deploy user + SSH, hand over web root
  with ACLs, write site Caddyfile and start the service
- Make the web root overridable via WEB_ROOT (default /var/www)

Linux/prepare-caddy-cicd.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+#
+# Caddy CI/CD Serving Preparation for Debian/Ubuntu
+# Prepares the server so a CI/CD pipeline can publish content that Caddy
+# serves: creates the deployment user 'bot' with its SSH access, creates and
+# hands over the web root to bot:caddy with ACLs that keep it readable by the
+# Caddy server, writes the default site Caddyfile and sample page, then starts
+# the Caddy service. The web root defaults to /var/www and can be overridden
+# by exporting the WEB_ROOT environment variable before running.
+#
+
+set -euo pipefail
+
+# Web root served by Caddy; override by exporting WEB_ROOT before running
+WEB_ROOT="${WEB_ROOT:-/var/www}"
+CADDY_CONF_DIR="/etc/caddy"
+
+# Ensure script is executed with root privileges
+if [ "$(id -u)" -ne 0 ]; then
+    echo "Error: This script must be run as root." >&2
+    exit 1
+fi
+
+if [ ! -f /etc/systemd/system/caddy.service ]; then
+    echo "Error: caddy.service not found. Run install-caddy.sh first." >&2
+    exit 1
+fi
+
+if ! getent group caddy >/dev/null 2>&1; then
+    echo "Error: group 'caddy' does not exist. Run install-caddy.sh first." >&2
+    exit 1
+fi
+
+echo "==> [1/5] Creating deployment user 'bot'..."
+# Create deployment user 'bot'
+if ! id -u bot >/dev/null 2>&1; then
+    useradd -m -s /bin/bash bot
+fi
+
+echo "==> [2/5] Configuring SSH directory for bot..."
+# Configure SSH directory for bot
+install -d -m 700 -o bot -g bot /home/bot/.ssh
+touch /home/bot/.ssh/authorized_keys
+chown bot:bot /home/bot/.ssh/authorized_keys
+chmod 600 /home/bot/.ssh/authorized_keys
+
+echo "==> [3/5] Creating web root and handing it to bot (${WEB_ROOT})..."
+if [ ! -d "${WEB_ROOT}" ]; then
+    mkdir -p "${WEB_ROOT}"
+
+    cat <<EOF > "${WEB_ROOT}/index.html"
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <title>Caddy Ready</title>
+</head>
+<body>
+    <h1>Caddy server is running</h1>
+    <p>Static files root: <code>${WEB_ROOT}</code></p>
+</body>
+</html>
+EOF
+else
+    echo "    '${WEB_ROOT}' already exists - leaving existing content untouched."
+fi
+
+# Set base ownership: bot (deployment) and caddy (web server group)
+chown -R bot:caddy "${WEB_ROOT}"
+
+# Directory base permissions (SGID ensures newly created items inherit group 'caddy')
+find "${WEB_ROOT}" -type d -exec chmod 2755 {} +
+find "${WEB_ROOT}" -type f -exec chmod 644 {} +
+
+# Apply POSIX ACLs: bot has rwx, caddy has read/execute, with default inheritance
+setfacl -R -m u:bot:rwx,u:caddy:rX "${WEB_ROOT}"
+setfacl -R -d -m u:bot:rwx,u:caddy:rX "${WEB_ROOT}"
+
+echo "==> [4/5] Writing site Caddyfile (${CADDY_CONF_DIR}/Caddyfile)..."
+mkdir -p "${CADDY_CONF_DIR}"
+chown root:caddy "${CADDY_CONF_DIR}"
+chmod 755 "${CADDY_CONF_DIR}"
+
+if [ ! -f "${CADDY_CONF_DIR}/Caddyfile" ]; then
+    cat <<EOF > "${CADDY_CONF_DIR}/Caddyfile"
+:80 {
+    root * ${WEB_ROOT}
+    file_server
+}
+EOF
+    chown root:caddy "${CADDY_CONF_DIR}/Caddyfile"
+    chmod 644 "${CADDY_CONF_DIR}/Caddyfile"
+else
+    echo "    '${CADDY_CONF_DIR}/Caddyfile' already exists - leaving it untouched."
+fi
+
+echo "==> [5/5] Starting Caddy service..."
+systemctl enable --now caddy
+
+echo "========================================================="
+echo " Caddy CI/CD preparation finished successfully!"
+echo " - Deployment user: bot (SSH keys accepted in authorized_keys)"
+echo " - Web Root: ${WEB_ROOT} (owned by bot:caddy, readable by caddy)"
+echo " - Config: ${CADDY_CONF_DIR}/Caddyfile"
+echo " - Status: $(systemctl is-active caddy)"
+echo "========================================================="