Caddy placeholder — wildcard cert OK, configurá los hosts reales en sites.d/