caddy: catch-all 404 on api.muchq.com and gpt.muchq.com

[aaylward]

found reviewing #1466. api.muchq.com and gpt.muchq.com have no catch-all, so an unmatched path (or a HEAD on a GET-only matcher) falls through and caddy answers an empty 200. two effects:

• probe_stats' served column reads ~100% on those vhosts — a scanner asking for /wp-login.php gets a 200 and the dashboard reports it as answered
• /iili/v1/r/x on gpt.muchq.com used to count as a followed short link (fixed in stats pipeline: named agents and scanner probe families #1466 by scoping SlugOf, but the 200 is still wrong)

api.1d4.net, mcp.1d4.net, and i.iili.uk already end in respond 404. the api.muchq.com block can't just add one: its routes are bare reverse_proxy @matcher directives, and caddy orders respond/handle before reverse_proxy, so a catch-all would swallow them. the fix is wrapping the bare directives in handle @matcher blocks first (the way git.muchq.com is written), then adding the catch-all, with a deploy_config_test pinning both.