feat: enhance canary mode in Nginx to Caddy migration script to preserve existing routes

TODO.md

@@ -28,6 +28,9 @@ work so we do not lose reasoning between sessions.
    - `--strict-backend-https` fails if any upstream is `http://`.
 5. Canary-first rollout:
    - first migration target is `tower.sintheus.com`.
+6. Canary mode is additive:
+   - preserves existing Caddy routes
+   - updates only a managed canary block for `tower.sintheus.com`.
 
 ## Host map and backend TLS status
 
@@ -109,3 +112,6 @@ Phase 7.5 is done only when all are true:
 3. Script does not change Cloudflare DNS records automatically.
    - DNS updates are intentional/manual to keep blast radius controlled.
 4. Do not set public Cloudflare proxied records to private `192.168.x.x` addresses.
+5. Canary updates are enclosed between markers:
+   - `# BEGIN_PHASE7_5_CANARY`
+   - `# END_PHASE7_5_CANARY`