Pin the Caddy image version #1691

deploy/consolidated/compose.yaml runs caddy:2-alpine. Every full deploy pulls, so a new upstream build recreates the edge proxy at an unreviewed version. That recreation is also what raced the reload in #1690.

Pin it to an exact version (caddy:2.x.y-alpine, optionally with a digest) so upgrades arrive as Renovate PRs, the way the observability images' exact tags do. Digest pins would need Renovate's docker:pinDigests preset, which renovate.json doesn't enable today.

postgres:18 and forgejo:16 float the same way and may want the same treatment.