Remove staging basic-auth wall — box is LAN-only

Staging runs on a private-network VM, not reachable from outside, so the
HTTP basic-auth layer was unnecessary defense-in-depth. Removing it also
lets the Caddyfile drop the render-around-Compose workaround entirely
(that workaround existed specifically because Compose's interpolation
mangles a bcrypt hash) — the noindex header and blog_public=0 stay, since
those guard against search-engine indexing, a separate concern from
network-level access.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -7,9 +7,7 @@
 # compose passes these into containers via ${VAR} interpolation, which will
 # silently mangle a value containing `$` followed by a letter (it tries to
 # resolve it as another variable and blanks it out if unset). Avoid `$` in
-# these specific values, or double it ($$) if you must use one. This does
-# NOT apply to STAGING_BASIC_AUTH_HASH below — that one's wired through
-# env_file instead specifically so a bcrypt hash's `$` signs are safe.
+# these specific values, or double it ($$) if you must use one.
 
 # --- Site ---
 # (WP_ENVIRONMENT_TYPE is NOT set here — it's hardcoded per environment in
@@ -30,12 +28,6 @@ DB_PASSWORD=changeme
 DB_ROOT_PASSWORD=changeme
 WP_TABLE_PREFIX=wp_
 
-# --- Staging only: basic-auth wall + noindex ---
-# Generate the hash with:
-#   docker run --rm caddy:2-alpine caddy hash-password --plaintext 'your-password'
-STAGING_BASIC_AUTH_USER=staging
-STAGING_BASIC_AUTH_HASH=
-
 # --- Backups (deploy/backup.sh) ---
 BACKUP_DIR=./backups
 BACKUP_REMOTE=