External mode robustness: command parsing, health classification, drift auto-resync

[gsmlg]

Problems in Caddy.Server.External

1. Naive command parsing — execute_shell_command/1 uses String.split(cmd_string) (lib/caddy/server/external.ex:358), so quoted arguments break. Support {executable, args} tuples in config :caddy, commands: or shell out via sh -c.

2. Coarse health classification — only econnrefused maps to :stopped (lib/caddy/server/external.ex:302); timeouts and ehostunreach land in :unknown with no distinction and no retry/backoff policy.

3. No drift policy — check_sync_status/0 exists but is on-demand only. Add an optional periodic drift check and a configurable policy:

   config :caddy, on_drift: :report | :resync   # default :report

4. Health check cost — Api.health_check/0 fetches the entire /config/ as a liveness probe. Caddy's cheap GET / would be lighter at scale.