Caddy TLS on a NAT-mapped public IP needs validation at the actual client URL
Caddy TLS on a NAT-mapped public IP needs validation at the actual client URL, especially when clients omit SNI. `tls internal` can work on the container's local address yet fail the public-IP handshake; test certificate chain and SANs from the external network without `-k`. A sc…