fix: caddy resolves own app via ${STACK_NAME}_app on shared proxy net

The caddy on-demand-TLS ask + reverse_proxy used bare host "app", which on the
shared external proxy net collides with every other stack aliasing its main
service "app" (docker DNS returns a foreign endpoint -> cert ask refused -> 000
on warm-canonical promote). Use the fully-qualified swarm service name
${STACK_NAME}_app (caddy {$APP_HOST} env) so caddy resolves THIS stack only.
Established coop-cloud pattern (cf. matrix-synapse, mailu, mumble). Bump
CADDYFILE_VERSION v1->v2.

Caddyfile

@@ -1,6 +1,6 @@
 {
 	on_demand_tls {
-		ask http://app:3000/tls-check
+		ask http://{$APP_HOST}:3000/tls-check
 	}
 }
 
@@ -8,5 +8,5 @@
 	tls {
 		on_demand
 	}
-	reverse_proxy app:3000
+	reverse_proxy {$APP_HOST}:3000
 }

README.md

@@ -150,5 +150,3 @@ as implemented by bluesky, although other pds implementations exist such as [coc
 # ❃
 
 recipe maintained by @notplants
-
-<!-- test commit for /recipe-create-pr skill (2026-05-18T15:53:31Z) -->

abra.sh

@@ -1,2 +1,2 @@
 export ENTRYPOINT_VERSION=v1
-export CADDYFILE_VERSION=v1
+export CADDYFILE_VERSION=v2

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: ghcr.io/bluesky-social/pds:0.4
+    image: ghcr.io/bluesky-social/pds:0.4.219
     networks:
       - internal
     environment:
@@ -36,7 +36,7 @@ services:
         max_attempts: 5
       labels:
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
-        - "coop-cloud.${STACK_NAME}.version=0.2.0+v0.4"
+        - "coop-cloud.${STACK_NAME}.version=0.3.0+v0.4.219"
         - "backupbot.backup=true"
     healthcheck:
       test: ["CMD", "wget", "-q", "--spider", "http://localhost:3000/xrpc/_health"]
@@ -52,6 +52,7 @@ services:
       - internal
     environment:
       - DOMAIN=${DOMAIN}
+      - APP_HOST=${STACK_NAME}_app
     configs:
       - source: caddyfile
         target: /etc/caddy/Caddyfile