Test site: DNS moves to the fleet nameservers, no Cloudflare proxy

cnxvinyl.lol's zone now lives in cnx-network-clan (ns1/ns2.cnx.network),
pointing straight at s1; mail is on mx1. Live once the nameservers at
Porkbun are switched.

- site/Caddyfile mirrors what s1 runs (checked 2026-10-23): no
  cloudflare_only or security_headers imports; Caddy gets its own certs.
- deploy-site.yml: drop the Cloudflare cache purge step and its secrets.
- site/README.md and digital-factory.md: DNS and certificate notes.

site/Caddyfile

@@ -2,22 +2,17 @@
 # Static web root /var/www/cnxvinyl.lol, filled by
 # .gitea/workflows/deploy-site.yml in the cnx_vinyl repo.
 #
-# Append these blocks to /etc/caddy/Caddyfile on s1. They reuse the
-# cloudflare_only and security_headers snippets defined there for
-# buildfor.life (buildfor_life_web: infra/caddy/Caddyfile.example); if
-# they are missing, validate fails with "File to import not found:
-# cloudflare_only" and they have to be copied in from the example first.
+# Append these blocks to /etc/caddy/Caddyfile on s1, then
 #   caddy validate --config /etc/caddy/Caddyfile
 #   systemctl reload caddy
+# This file mirrors what s1 runs (checked 2026-10-23); keep the two in step.
 #
-# Cloudflare: both names proxied (orange cloud), SSL/TLS mode "Full (strict)".
-# "Flexible" sends plain HTTP to Caddy, which redirects to HTTPS: a loop.
-# Same rule as the buildfor.life apex: if a record is ever switched to DNS
-# only, remove "import cloudflare_only" first or that name goes dark.
+# DNS: the cnxvinyl.lol zone lives in the cnx-network-clan repo
+# (modules/dns/zones/cnxvinyl.lol.zone, served by ns1/ns2.cnx.network) and
+# points straight at s1, not through Cloudflare. Caddy gets its own
+# certificates (HTTP-01/TLS-ALPN on 80/443), so no Cloudflare-only rule.
 
 cnxvinyl.lol {
-	import cloudflare_only
-	import security_headers
 	header X-Frame-Options "SAMEORIGIN"
 	# Internal testing: keep every page and file out of search engines.
 	header X-Robots-Tag "noindex, nofollow"
@@ -35,6 +30,5 @@ cnxvinyl.lol {
 }
 
 www.cnxvinyl.lol {
-	import cloudflare_only
 	redir https://cnxvinyl.lol{uri} permanent
 }