fix(caddy): make roms.ginnoir.com internal-only

External access for a trusted friend now goes through the share stack's
Tailscale serve node (roms-share.<tailnet>.ts.net), so roms.ginnoir.com
no longer needs public exposure. Add import internal_only (LAN + tailnet).

Caddyfile

@@ -119,9 +119,12 @@ stash.ginnoir.com {
 }
 
 # =============================================================
-# GAMES / ROMS — public (temporarily; RomM has its own auth)
+# GAMES / ROMS — internal only
+# External access for a trusted friend is via the `share` stack's Tailscale
+# serve node (roms-share.<tailnet>.ts.net), NOT public exposure here.
 # =============================================================
 roms.ginnoir.com {
+	import internal_only
 	reverse_proxy romm:8080
 }