Scope app to /thermograph, free the domain root for a portfolio (#10)

- Drop the app-level "/" redirect so the FastAPI app no longer claims the
  domain root; it stays scoped to THERMOGRAPH_BASE (/thermograph). Root now
  404s at the app, leaving it for another service behind the proxy.
- Caddyfile: serve a static portfolio at / and reverse-proxy /thermograph* to
  uvicorn, on emigriffith.dev with automatic Let's Encrypt TLS.
- Default THERMOGRAPH_BASE to /thermograph in the env example to match.

deploy/Caddyfile

@@ -1,24 +1,40 @@
 # /etc/caddy/Caddyfile on the VPS.
-# Replace thermograph.example.com with your real hostname. Its A/AAAA record
-# must already point at this VPS — Caddy provisions a Let's Encrypt cert on
-# first request and auto-renews. Nothing else to do for TLS.
+# The domain's A/AAAA record must already point at this VPS — Caddy provisions a
+# Let's Encrypt cert on first request and auto-renews. Nothing else to do for TLS
+# (just make sure ports 80 and 443 are open).
+#
+# Layout on this domain:
+#   /                -> static portfolio site (served straight from disk)
+#   /thermograph/*   -> reverse-proxied to the Thermograph uvicorn (loopback)
+#
+# Thermograph must run with THERMOGRAPH_BASE=/thermograph (see /etc/thermograph.env)
+# so the app serves itself under that prefix. The app no longer claims "/", so the
+# root is free for the portfolio.
 
-thermograph.example.com {
+emigriffith.dev {
 	encode zstd gzip
 
-	# Reverse-proxy to the loopback uvicorn (see thermograph.service).
+	# Thermograph — the app serves all pages, assets, and API under /thermograph.
+	# Match both the bare prefix and everything beneath it; the app redirects the
+	# bare /thermograph to /thermograph/.
+	handle /thermograph /thermograph/* {
 		reverse_proxy 127.0.0.1:8137
+	}
+
+	# Portfolio at the root. Point `root` at the built static site (for the Astro
+	# portfolio that's its `dist/` output). file_server serves index.html for
+	# directories and returns a real 404 for missing paths.
+	handle {
+		root * /var/www/emigriffith
+		file_server
+	}
 
 	log {
-		output file /var/log/caddy/thermograph.log
+		output file /var/log/caddy/emigriffith.log
 	}
 }
 
-# If you keep THERMOGRAPH_BASE=/thermograph instead of serving at the root,
-# use this block instead of the one above:
-#
-# thermograph.example.com {
-# 	encode zstd gzip
-# 	reverse_proxy /thermograph/* 127.0.0.1:8137
-# 	redir / /thermograph/
+# Optional: redirect www -> apex. Add a www CNAME/A record first, then uncomment.
+# www.emigriffith.dev {
+# 	redir https://emigriffith.dev{uri} permanent
 # }

deploy/thermograph.env.example

@@ -5,6 +5,7 @@
 PORT=8137
 
 # Base path the app is served under.
-#   /            -> app at the domain root  (recommended on a dedicated domain)
-#   /thermograph -> app under a sub-path     (if sharing the host with other apps)
-THERMOGRAPH_BASE=/
+#   /thermograph -> app under a sub-path  (share the host with other apps, e.g. a
+#                   portfolio at the root — this is what the Caddyfile expects)
+#   /            -> app at the domain root (only if Thermograph owns the whole domain)
+THERMOGRAPH_BASE=/thermograph