v0.23.0 — every live name behind the proxy

A certificate a stock client will accept

• moshcode dns start --proxy answers every live Moshpit name with the local pinned-TLS proxy instead of the name's origin.
• The proxy reads the SNI, checks the origin's key against the registry pin, and re-signs with a root this machine generated — the only way a stock browser can be told the result, since no CA will ever sign for a Moshpit name.
• Previously the proxy could sit on loopback with nothing routed to it, so every name still arrived as a self-signed certificate no matter what was installed.
• --proxy probes 127.0.0.1 and ::1 by default; --proxy <host> probes only the host you name.
• It refuses to start when nothing is listening on 443, rather than pointing every name on the machine at a closed port and turning a certificate problem into a total outage.
• Reachability is rechecked rather than remembered: a proxy that dies after the resolver started is the same outage as one that was never running.
• A proxy that speaks only one address family answers NODATA for the other, not a fabricated address that would refuse the connection.
• Parked names still reach the parking page. They have no origin and no published pin, so handing one to the proxy would turn "this name is for sale" into a TLS error.

Also

• New caddy-proxy example template: Caddyfile, README, and a systemd unit for putting a Moshpit name in front of a local service.

Requires moshpit-proxy listening on 443. Everything outside --proxy is unchanged.