Retire Gondulf and move StarPunk to v2.0.0 with Pocket ID login

StarPunk 2.0.0 logs in with Pocket ID and issues its own Micropub tokens
(ADR-064 in the StarPunk repo), so the Gondulf IndieAuth server is no
longer used. Removes its task, templates, Caddy route, subdomain and
service entry, and moves its DNS record to removed_records.

The StarPunk template was still on v1.6.0-rc.2 with Gondulf hairpin
hosts; deploying it would have broken login. It now matches production:
v2.0.0, Pocket ID hairpin, OIDC client from vault_starpunk.pocketid and
the admin sub in starpunk_admin_sub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/templates/Caddyfile.j2

@@ -88,10 +88,6 @@ pdg.thesatelliteoflove.com {
     }
 }
 
-gondulf.thesatelliteoflove.com {
-    reverse_proxy gondulf:8000
-  }
-
 starpunk.thesatelliteoflove.com {
     reverse_proxy starpunk:8000
   }

roles/docker/templates/gondulf-compose.yml.j2

@@ -1,34 +0,0 @@
-services:
-  gondulf:
-    image: git.thesatelliteoflove.com/phil/gondulf:1.0.1
-    container_name: gondulf
-    restart: unless-stopped
-    extra_hosts:
-      - '{{ primary_domain }}:{{ docker.hairpin_ip }}'
-    volumes:
-      - gondulf_data:/data
-    env_file:
-      - .env
-    environment:
-      - GONDULF_HTTPS_REDIRECT=true
-      - GONDULF_SECURE_COOKIES=true
-      - GONDULF_TRUST_PROXY=true
-      - GONDULF_TOKEN_EXPIRY=3600
-      - GONDULF_CODE_EXPIRY=600
-      - GONDULF_TOKEN_CLEANUP_ENABLED=false
-      - GONDULF_TOKEN_CLEANUP_INTERVAL=3600
-      - GONDULF_LOG_LEVEL=INFO
-      - GONDULF_DEBUG=false
-    healthcheck:
-      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8000/health"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 10s
-volumes:
-  # Existing volume (gondulf_gondulf_data) holds the SQLite database
-  gondulf_data:
-networks:
-  default:
-    external: true
-    name: {{ docker.network_name }}

roles/docker/templates/gondulf-env.j2

@@ -1,9 +0,0 @@
-GONDULF_SECRET_KEY={{ vault_gondulf.secret_key }}
-GONDULF_BASE_URL=https://{{ subdomains.gondulf }}
-GONDULF_DATABASE_URL=sqlite:////data/gondulf.db
-GONDULF_SMTP_HOST={{ smtp.host }}
-GONDULF_SMTP_PORT=587
-GONDULF_SMTP_USERNAME={{ smtp.username }}
-GONDULF_SMTP_PASSWORD={{ vault_smtp.password }}
-GONDULF_SMTP_FROM=gondulf@{{ smtp.from_domain }}
-GONDULF_SMTP_USE_TLS=true

roles/docker/templates/starpunk-compose.yml.j2

@@ -1,10 +1,10 @@
 services:
   starpunk:
-    image: git.thesatelliteoflove.com/phil/starpunk:v1.6.0-rc.2
+    image: git.thesatelliteoflove.com/phil/starpunk:v2.0.0
     container_name: starpunk
     restart: unless-stopped
     extra_hosts:
-      - '{{ subdomains.gondulf }}:{{ docker.hairpin_ip }}'
+      - '{{ subdomains.pocketid }}:{{ docker.hairpin_ip }}'
       - '{{ primary_domain }}:{{ docker.hairpin_ip }}'
     volumes:
       - starpunk-data:/data
@@ -14,9 +14,16 @@ services:
       SITE_NAME: StarPunk
       SITE_AUTHOR: Mr Whiskers
       SITE_DESCRIPTION: Starpunk instance
-      # Authentication
+      # Site owner identity (h-card source, Micropub "me")
       ADMIN_ME: https://{{ primary_domain }}
       SESSION_SECRET: {{ vault_starpunk.session_secret }}
+      # Admin login via Pocket ID (client "StarPunk"); only this user may log in.
+      # StarPunk issues Micropub tokens itself (ADR-064).
+      OIDC_ISSUER: https://{{ subdomains.pocketid }}
+      OIDC_CLIENT_ID: {{ vault_starpunk.pocketid.client_id }}
+      OIDC_CLIENT_SECRET: {{ vault_starpunk.pocketid.client_secret }}
+      OIDC_ADMIN_SUB: {{ starpunk_admin_sub }}
+      OIDC_PROVIDER_NAME: Pocket ID
       # Production settings
       FLASK_ENV: production
       FLASK_DEBUG: 0