Serve WebFinger on the apex domain for Tailscale and the fediverse

Tailscale finds the tailnet's login provider through the OpenID issuer
link in phil@'s WebFinger record, which now points at Pocket ID. The
same record carries GoToSocial's links, since the apex is its account
domain; other fediverse discovery paths redirect to GoToSocial. All of
these returned 404 before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/templates/Caddyfile.j2

@@ -45,6 +45,22 @@ git.thesatelliteoflove.com {
 }
 
 thesatelliteoflove.com {
+    # WebFinger for phil@ serves two readers: the fediverse (GoToSocial's account
+    # domain is this apex) and Tailscale, which finds the tailnet's login
+    # provider through the OpenID issuer link.
+    @webfinger_phil {
+        path /.well-known/webfinger
+        query resource=acct:phil@{{ primary_domain }}
+    }
+    route {
+        header @webfinger_phil Content-Type application/jrd+json
+        header @webfinger_phil Access-Control-Allow-Origin *
+        respond @webfinger_phil `{"subject":"acct:phil@{{ primary_domain }}","aliases":["https://{{ subdomains.social }}/users/phil","https://{{ subdomains.social }}/@phil"],"links":[{"rel":"http://openid.net/specs/connect/1.0/issuer","href":"https://{{ subdomains.pocketid }}"},{"rel":"http://webfinger.net/rel/profile-page","type":"text/html","href":"https://{{ subdomains.social }}/@phil"},{"rel":"self","type":"application/activity+json","href":"https://{{ subdomains.social }}/users/phil"}]}` 200
+        # Other fediverse discovery goes to GoToSocial.
+        redir /.well-known/webfinger https://{{ subdomains.social }}{uri} 301
+        redir /.well-known/host-meta* https://{{ subdomains.social }}{uri} 301
+        redir /.well-known/nodeinfo https://{{ subdomains.social }}{uri} 301
+    }
     root * /srv/tsol
     file_server
 }