update.sh: regenerate Caddyfile so template changes land on hosts

Caddyfile generation lived inline in install.sh, which meant that
operators who pulled a Caddy-template change and ran update.sh got
the new backend / frontend code but kept their old Caddyfile. The
recent path+Accept-header routing fix did not reach a running
deployment until install.sh was re-run.

Extracted the generator into bin/pip-write-caddyfile.sh, a
standalone script that reads TLS_MODE / PIP_DOMAIN / DATA_ROOT from
.env.compose. install.sh now delegates to it (single source of
truth, no template drift) and update.sh calls it on every run so
operators do not need to know to re-run install.sh after a code
change to the proxy config.

The bootstrap self-signed cert generator moved into the same script
and gained an existing-cert check so update.sh runs do not
needlessly regenerate the cert on every invocation. install.sh's
now-dead detect_host_ips and generate_bootstrap_cert helpers
removed.

To apply on a running deployment that hit the recent admin /
projects / workflows JSON-401 issue:

  cd /opt/pip
  sudo git pull origin main
  sudo bash bin/pip-write-caddyfile.sh

That writes the new Caddyfile and reloads caddy without touching
the rest of the stack.