Remove staging basic-auth wall — box is LAN-only

Staging runs on a private-network VM, not reachable from outside, so the
HTTP basic-auth layer was unnecessary defense-in-depth. Removing it also
lets the Caddyfile drop the render-around-Compose workaround entirely
(that workaround existed specifically because Compose's interpolation
mangles a bcrypt hash) — the noindex header and blog_public=0 stay, since
those guard against search-engine indexing, a separate concern from
network-level access.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker/caddy/Caddyfile.staging

@@ -2,18 +2,8 @@
 	encode gzip
 
 	# Launch gate: "No staging URLs are publicly indexed." Belt-and-suspenders
-	# with wp_option blog_public=0, which deploy.sh sets on staging.
-	#
-	# The two tokens below are substituted by deploy.sh directly (bash string
-	# replacement), not by Caddy's {$VAR} or docker compose's ${VAR} — a
-	# bcrypt hash contains `$identifier`-looking substrings that Compose's
-	# own interpolation will silently corrupt if this value ever passes
-	# through it (confirmed: both `environment:` and `env_file:` are
-	# affected). This file is a tracked template; deploy.sh renders it into
-	# docker/caddy/.generated/Caddyfile.staging, which is what's mounted.
-	basic_auth {
-		__STAGING_BASIC_AUTH_USER__ __STAGING_BASIC_AUTH_HASH__
-	}
+	# with wp_option blog_public=0, which deploy.sh sets on staging. No
+	# basic-auth wall — this box is LAN-only, not reachable from outside.
 	header X-Robots-Tag "noindex, nofollow, noarchive"
 
 	root * /var/www/html