Pi-hole DNS records for *.hake.rodeo must point to Caddy, not the service

Local DNS records for *.hake.rodeo subdomains must resolve to Caddy (10.1.10.101), not to the individual service IP. Caddy terminates TLS and reverse proxies to the backend. Pointing DNS directly to the service bypasses Caddy and causes TLS handshake failures.