Rebuild deploy process on the project template

- Dockerfile: deps → builder → pb-downloader → runner stages, cross-arch
  (BUILDPLATFORM node stages, TARGETARCH PocketBase binary), Debian slim
  runner, VOLUME /app/pb_data, dual healthcheck, docker-entrypoint.sh
- docker-entrypoint.sh: bash supervisor replacing scripts/run-all.mjs
- Makefile: build-production (multi-arch push from git remote),
  build-check, build-check-local
- deploy.sh [tag]: make build-production then ansible-playbook with tag
- drop .env/.env.example (credentials live in ansible/vars/default.yml)

Makefile

@@ -0,0 +1,28 @@
+.PHONY: build-production
+build-production: ## Build the production docker image and push to private registry
+	@docker buildx build \
+		--platform linux/amd64,linux/arm64 \
+		--tag registry.tanshu.com/tanshu/greatbear:latest \
+		$(if $(filter-out latest,$(TAG)),--tag registry.tanshu.com/tanshu/greatbear:$(TAG)) \
+		--push \
+		--pull \
+		git@git.tanshu.com:tanshu/greatbear.git
+
+.PHONY: build-check
+build-check: ## Multi-arch build without push (compile check)
+	@docker buildx build \
+		--platform linux/amd64,linux/arm64 \
+		--tag greatbear:test \
+		--pull \
+		--progress=plain \
+		git@git.tanshu.com:tanshu/greatbear.git
+
+.PHONY: build-check-local
+build-check-local: ## Build from the committed local tree (git archive) and load into docker
+	@git archive --format=tar HEAD | docker buildx build \
+		--platform linux/amd64 \
+		--tag greatbear:test \
+		--pull \
+		--progress=plain \
+		--load \
+		-