feat: mark proxy-originated errors and pin container DNS

- handle_errors sets X-Proxy-Error (dial|upstream) and X-Proxy-Error-Detail
  so clients with several proxies can fail over when the upstream was
  never reached, instead of treating the proxy's 502 as the upstream's
- explicit dns in compose: the container no longer inherits a host
  resolver that may disappear (systemd-resolved was switched off on the
  VM and every lookup failed until a restart)
- strip X-Proxy-Token from Caddy logs (it was logged in clear text)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -12,6 +12,13 @@ services:
       # Legacy plain-HTTP endpoint (unchanged for existing clients)
       - "8082:8080"
     env_file: .env
+    # Explicit resolvers instead of inheriting the host's: Docker snapshots
+    # the host resolv.conf at container start, so switching the host off
+    # systemd-resolved (127.0.0.53) left Caddy with a dead resolver and every
+    # upstream lookup failing until the container was restarted.
+    dns:
+      - 1.1.1.1
+      - 8.8.8.8
     volumes:
       # Let's Encrypt certificates and ACME account keys — MUST persist,
       # otherwise every recreate re-issues certs and burns LE rate limits