Scope app to /thermograph, free the domain root for a portfolio (#10)

- Drop the app-level "/" redirect so the FastAPI app no longer claims the
  domain root; it stays scoped to THERMOGRAPH_BASE (/thermograph). Root now
  404s at the app, leaving it for another service behind the proxy.
- Caddyfile: serve a static portfolio at / and reverse-proxy /thermograph* to
  uvicorn, on emigriffith.dev with automatic Let's Encrypt TLS.
- Default THERMOGRAPH_BASE to /thermograph in the env example to match.

app.py

@@ -430,9 +430,9 @@ def _page(name):
     return FileResponse(os.path.join(FRONTEND_DIR, name))
 
 
-# Bare domain and the un-slashed base both land on the app's index. The trailing
-# slash matters: the frontend's relative asset URLs resolve against BASE/ .
-app.add_api_route("/", lambda: RedirectResponse(url=f"{BASE}/"), methods=["GET"], include_in_schema=False)
+# The un-slashed base redirects to BASE/ so the frontend's relative asset URLs
+# resolve correctly. The app stays scoped to BASE and never claims "/", leaving
+# the domain root free for another app (e.g. a portfolio) to own via the proxy.
 app.add_api_route(BASE, lambda: RedirectResponse(url=f"{BASE}/"), methods=["GET"], include_in_schema=False)
 app.add_api_route(f"{BASE}/", lambda: _page("index.html"), methods=["GET"], include_in_schema=False)
 app.add_api_route(f"{BASE}/calendar", lambda: _page("calendar.html"), methods=["GET"], include_in_schema=False)