Remove staging basic-auth wall — box is LAN-only

Staging runs on a private-network VM, not reachable from outside, so the
HTTP basic-auth layer was unnecessary defense-in-depth. Removing it also
lets the Caddyfile drop the render-around-Compose workaround entirely
(that workaround existed specifically because Compose's interpolation
mangles a bcrypt hash) — the noindex header and blog_public=0 stay, since
those guard against search-engine indexing, a separate concern from
network-level access.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -44,17 +44,17 @@ drops into the app container.
 
 ```
 cp .env.example .env.staging
-# fill in SITE_DOMAIN, SITE_URL, DB_*, and:
-docker run --rm caddy:2-alpine caddy hash-password --plaintext 'pick-a-password'
-# -> paste result into STAGING_BASIC_AUTH_HASH
+# fill in SITE_DOMAIN, SITE_URL, DB_*
 
 make deploy ENV=staging
 ```
 
-Staging is `noindex`'d and sits behind HTTP basic auth (Caddyfile.staging)
-in addition to `blog_public=0` — two independent reasons search engines and
-random visitors won't see it, per the launch gate. Mail never leaves the
-box: it's caught by MailHog, viewable at `:8025`.
+Staging is `noindex`'d (`blog_public=0` plus the `X-Robots-Tag` header in
+Caddyfile.staging) so search engines won't index it — there's no basic-auth
+wall on top of that, since this box is LAN-only and not reachable from
+outside. If that ever changes (a public domain, port-forwarding, etc.),
+basic-auth is worth adding back before that happens, not after. Mail never
+leaves the box: it's caught by MailHog, viewable at `:8025`.
 
 ### Theme: Blocksy + the Book Store starter site