Remove staging basic-auth wall — box is LAN-only

Staging runs on a private-network VM, not reachable from outside, so the
HTTP basic-auth layer was unnecessary defense-in-depth. Removing it also
lets the Caddyfile drop the render-around-Compose workaround entirely
(that workaround existed specifically because Compose's interpolation
mangles a bcrypt hash) — the noindex header and blog_public=0 stay, since
those guard against search-engine indexing, a separate concern from
network-level access.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.staging.yml

@@ -16,14 +16,10 @@ services:
     ports:
       - "80:80"
       - "443:443"
-    # SITE_DOMAIN is safe to pass through normally (no `$` in a domain name).
-    # STAGING_BASIC_AUTH_USER/HASH are NOT passed via compose at all — see
-    # the comment in docker/caddy/Caddyfile.staging for why; deploy.sh
-    # renders them directly into the mounted file below instead.
     env_file:
       - .env.staging
     volumes:
-      - ./docker/caddy/.generated/Caddyfile.staging:/etc/caddy/Caddyfile:ro
+      - ./docker/caddy/Caddyfile.staging:/etc/caddy/Caddyfile:ro
       - wp_core:/var/www/html:ro
       - wp_uploads:/var/www/html/wp-content/uploads:ro
       - wp_themes:/var/www/html/wp-content/themes:ro