Test site: DNS moves to the fleet nameservers, no Cloudflare proxy

cnxvinyl.lol's zone now lives in cnx-network-clan (ns1/ns2.cnx.network),
pointing straight at s1; mail is on mx1. Live once the nameservers at
Porkbun are switched.

- site/Caddyfile mirrors what s1 runs (checked 2026-10-23): no
  cloudflare_only or security_headers imports; Caddy gets its own certs.
- deploy-site.yml: drop the Cloudflare cache purge step and its secrets.
- site/README.md and digital-factory.md: DNS and certificate notes.

docs/digital-factory.md

@@ -1003,7 +1003,8 @@ Build onward, part-time at launch; add it to the headcount.
 - Customer portal domain: the plant's brand domain (new zone on ns1/ns2,
   second cert on `web01`) or a name under `cnx.network` for launch.
   Internal testing has its own domain, `cnxvinyl.lol` (registered
-  2026-10-02, DNS on Cloudflare): a static demo site built from
+  2026-10-02 at Porkbun; DNS moved from Cloudflare to the fleet nameservers
+  ns1/ns2 in October 2026, mail on `mx1`): a static demo site built from
   [`site/`](../site/README.md) and served by the buildfor.life web server,
   not a plant service. The brand domain decision stays open.
 - Portal availability during a plant WAN outage: accept it (the portal is