The caddy on-demand-TLS ask + reverse_proxy used bare host "app", which on the
shared external proxy net collides with every other stack aliasing its main
service "app" (docker DNS returns a foreign endpoint -> cert ask refused -> 000
on warm-canonical promote). Use the fully-qualified swarm service name
${STACK_NAME}_app (caddy {$APP_HOST} env) so caddy resolves THIS stack only.
Established coop-cloud pattern (cf. matrix-synapse, mailu, mumble). Bump
CADDYFILE_VERSION v1->v2.
Pin an exact released image tag. The previous pin :0.4 is a moving tag
that upstream now republishes with main-branch builds (currently
@atproto/pds 0.5.1 on Node 24, where the service entrypoint moved from
/app/index.js to /app/index.ts), so the recipe's entrypoint.sh
(exec node --enable-source-maps index.js) crash-loops MODULE_NOT_FOUND.
ghcr.io/bluesky-social/pds:0.4.219 is the newest released exact tag and
keeps the layout this recipe's entrypoint expects (Node 20.20,
/app/index.js, dumb-init).
