Build Caddy with the caddy-dns/desec module

Stock caddy:2-alpine plus caddy-dns/desec, for ACME DNS-01 against zones
hosted at deSEC (*.llm.aneur.in in cloud/cloud's llm stack). CI builds
and checks the module on pull requests, and pushes :latest (keeping
:previous) on main, weekly and by hand.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -0,0 +1,30 @@
+# caddy-desec-docker
+
+Stock [Caddy](https://caddyserver.com) plus the
+[caddy-dns/desec](https://github.com/caddy-dns/desec) module, so Caddy can
+get certificates by ACME DNS-01 against a zone hosted at
+[deSEC](https://desec.io). Published as
+`code.aneur.in/cloud/caddy-desec-docker:latest` (linux/amd64).
+
+Used by the `llm` stack in [cloud/cloud](https://code.aneur.in/cloud/cloud)
+for `*.llm.aneur.in`:
+
+```
+{
+	acme_dns desec {
+		token {env.DESEC_TOKEN}
+	}
+}
+```
+
+## Builds
+
+- **Push to `main`, weekly, or by hand** (`build.yml`): builds the image,
+  checks the deSEC module is present, then pushes `:latest`, keeping the
+  previous one as `:previous`. The weekly run picks up new Caddy and module
+  releases without a commit.
+- **Pull requests** (`pr-checks.yml`): the same build and module check,
+  without pushing.
+
+The push uses the `BUILD_API_TOKEN` Actions secret, a Gitea token with
+package write access.