headscale: drop the dead Headplane admin route

Caddy proxied /admin* to Headplane behind basic auth, but nothing in this repo
ever installed Headplane, so the route led nowhere. The vhost is now a plain
reverse proxy: the headscale API authenticates every request itself.

The headscale_ui_* vault entries are now unused and can be removed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ansible/services/headscale/deploy_headscale_playbook.yml

@@ -244,23 +244,9 @@
       vars:
         caddy_site_name: headscale
         caddy_site_domain: "{{ headscale_domain }}"
-        # Raw body, and it must stay raw: the /admin* route in front of
-        # Headplane is not expressible as a plain reverse_proxy. The previous
-        # version of this task wrote only `reverse_proxy localhost:8080`, which
-        # would have deleted the admin route and its auth on the next run.
-        caddy_site_body: |
-          @headplane {
-              path /admin*
-          }
-          handle @headplane {
-              basicauth {
-                  {{ headscale_ui_username }} {{ headscale_ui_password_hash }}
-              }
-              reverse_proxy http://localhost:{{ headplane_port }}
-          }
-          # Headscale API is protected by its own API key authentication
-          # All API operations require a valid Bearer token in the Authorization header
-          reverse_proxy * http://localhost:{{ headscale_port }}
+        # The Headscale API authenticates every request itself (Bearer API
+        # key), so a plain proxy is all it needs.
+        caddy_site_upstream: "localhost:{{ headscale_port }}"
 
   handlers:
     - name: Restart headscale