fix: use oci-containers for caddy (proper daemon-reload), keep user quadlets

modules/common/podman.nix

@@ -2,7 +2,26 @@
 {
   virtualisation.podman.enable = true;
 
-  # User containers (rootless, as the containers user)
+  # System-level containers (rootful, can bind low ports)
+  # Declared here so NixOS handles daemon-reload properly
+  virtualisation.oci-containers = {
+    backend = "podman";
+    containers = {
+      caddy = {
+        image = "caddy:latest";
+        ports = [
+          "80:80"
+          "443:443"
+        ];
+        volumes = [
+          "/var/lib/caddy/data:/data"
+          "/var/lib/caddy/config:/config"
+        ];
+      };
+    };
+  };
+
+  # User containers (rootless, as the containers user via quadlets)
   system.activationScripts.containers-quadlets = {
     text = ''
       mkdir -p /var/lib/containers/.config/containers/systemd
@@ -11,13 +30,4 @@
     '';
     deps = [ "users" ];
   };
-
-  # System containers (rootful, can bind low ports like 80/443)
-  system.activationScripts.system-containers-quadlets = {
-    text = ''
-      mkdir -p /etc/containers/systemd
-      cp -r ${./system-containers}/* /etc/containers/systemd/
-    '';
-    deps = [ "users" ];
-  };
 }