Wire thiswebsitedoesnotexist.service into deployment pipeline

- Move unit file from services/systemd/helsinki-a/ to
  services/thiswebsitedoesnotexist/ (matches systemd_services role convention)
- Add systemd_services: [thiswebsitedoesnotexist] to helsinki-a host_vars
- Add systemd_services role to helsinki-a stage in deploy.yml
- Remove redundant caddy.service (apt manages this via the caddy role)

Closes PESO-117

ansible/deploy.yml

@@ -53,6 +53,7 @@
   roles:
     - role: caddy
     - role: status_page
+    - role: systemd_services
 
 # london-b: Docker services (storage, apps) + media stack + backups
 - name: "Stage 4b: Services (london-b)"

ansible/inventory/host_vars/helsinki-a.yml

@@ -10,6 +10,9 @@ docker_services:
   - forgejo
   - bitwarden
 
+systemd_services:
+  - thiswebsitedoesnotexist
+
 node_exporter_bind_tailscale: true
 
 common_ufw_allowed_ports:

ansible/services/systemd/helsinki-a/caddy.service

@@ -1,25 +0,0 @@
-# Stock Caddy service unit (installed via package manager)
-# Included for reference — not a custom unit
-#
-# Config file: /etc/caddy/Caddyfile
-
-[Unit]
-Description=Caddy
-Documentation=https://caddyserver.com/docs/
-After=network.target network-online.target
-Requires=network-online.target
-
-[Service]
-Type=notify
-User=caddy
-Group=caddy
-ExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile
-ExecReload=/usr/bin/caddy reload --config /etc/caddy/Caddyfile --force
-TimeoutStopSec=5s
-LimitNOFILE=1048576
-PrivateTmp=true
-ProtectSystem=full
-AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
-
-[Install]
-WantedBy=multi-user.target