Rebuild deploy process on the project template

- Dockerfile: deps → builder → pb-downloader → runner stages, cross-arch
  (BUILDPLATFORM node stages, TARGETARCH PocketBase binary), Debian slim
  runner, VOLUME /app/pb_data, dual healthcheck, docker-entrypoint.sh
- docker-entrypoint.sh: bash supervisor replacing scripts/run-all.mjs
- Makefile: build-production (multi-arch push from git remote),
  build-check, build-check-local
- deploy.sh [tag]: make build-production then ansible-playbook with tag
- drop .env/.env.example (credentials live in ansible/vars/default.yml)

README.md

@@ -9,7 +9,7 @@ Stitch "Industrial Hospitality" design.
 | Backend   | [PocketBase](https://pocketbase.io) v0.40 — CMS content, form intake, admin UI |
 | Runtime   | Single Docker image running both services                   |
 | Proxy     | Caddy (automatic HTTPS) on the target host                  |
-| Deploys   | `deploy.sh` (build + push) → Ansible playbook (pull + run)  |
+| Deploys   | `deploy.sh [tag]` (Makefile buildx push) → Ansible playbook |
 
 ## Pages
 
@@ -33,12 +33,13 @@ app/                 TanStack Start application
   public/images/     Design assets (downloaded from the Stitch export)
 pb/migrations/       PocketBase schema (snapshot migration, auto-applied)
 scripts/
-  run-all.mjs        Container supervisor: PocketBase + site server
   seed.mjs           Idempotent content seeder (create-if-missing by uid)
   create-collections.sh   Dev helper used to build the schema migration
 ansible/             Deployment playbook (roles: network, greatbear, caddy)
-Dockerfile           Multi-stage image build
-deploy.sh            Build & push image to the private registry
+Makefile             Multi-arch buildx targets (build-production / build-check)
+Dockerfile           Multi-stage image build (deps → builder → pb-downloader → runner)
+docker-entrypoint.sh Container supervisor: PocketBase + site server
+deploy.sh            Build & push image, then run the Ansible deploy
 ```
 
 ## Local development
@@ -86,16 +87,25 @@ docker run --rm -p 3000:3000 -p 8090:8090 \
 
 ## Deploying
 
-### 1. Build and push the image
+The image is always built from the **committed state of the git remote** — commit and push
+before deploying. Registry credentials: `docker login registry.tanshu.com` (once per machine).
 
 ```bash
-cp .env.example .env      # then fill in registry credentials
-./deploy.sh
+./deploy.sh              # build + push :latest, then deploy that tag via Ansible
+./deploy.sh v1.2.3       # same, with an explicit version tag
 ```
 
-Tags pushed: `registry.tanshu.com/tanshu/greatbear:latest` and `:<git-sha>`.
+Or run the pieces yourself:
 
-### 2. Deploy with Ansible
+```bash
+make build-production TAG=v1.2.3   # multi-arch (amd64+arm64) buildx build & push
+make build-check                   # multi-arch compile check (no push)
+make build-check-local             # build the committed local tree (git archive) and load it
+
+cd ansible && ansible-playbook playbook.yml -e "tag=v1.2.3"
+```
+
+### Ansible deployment
 
 Requirements on the controller: `ansible` + `community.docker` collection (see
 `ansible/requirements.yml`). Requirements on the host: Docker with a Caddy **container** named
@@ -107,10 +117,11 @@ ansible-galaxy install -r requirements.yml
 ansible-playbook playbook.yml    # targets inventory host `monoco` — edit playbook.yml if needed
 ```
 
-All deployment variables live in `ansible/vars/default.yml`. The playbook:
+All deployment variables live in `ansible/vars/default.yml` (registry, tag, domains,
+PocketBase admin credentials). The playbook:
 
 1. Ensures the `greatbear_net` Docker network exists with the Caddy container attached.
-2. Pulls `registry.tanshu.com/tanshu/greatbear:latest`, uploads `/var/lib/greatbear/.env`,
+2. Pulls `registry.tanshu.com/tanshu/greatbear:{tag}`, uploads `/var/lib/greatbear/.env`,
    and (re)creates the `greatbear` container on that network with
    `/var/lib/greatbear/pb_data` bind-mounted to `/app/pb_data`, then waits for its healthcheck.
 3. Inserts a managed snippet into the shared Caddyfile and reloads Caddy via
@@ -129,7 +140,8 @@ automatically on first request.
 
 - URL: `https://admin.greatbear.in/_/`
 - First container start bootstraps the superuser from `PB_SUPERUSER_EMAIL` /
-  `PB_SUPERUSER_PASSWORD` (set in `ansible/group_vars/greatbear/vars.yml`, idempotent).
+  `PB_SUPERUSER_PASSWORD` (templated from `pb_admin_email` / `pb_admin_password` in
+  `ansible/vars/default.yml`, idempotent).
 
 Content collections: `brews`, `menu_categories`, `menu_items`, `experiences`, `testimonials`,
 `stats`, `pairings`, `settings`. Reservation/contact submissions land in `reservations`
@@ -143,7 +155,8 @@ are never overwritten by redeploys. Schema changes belong in `pb/migrations/`.
 | Variable                | Default                  | Purpose                                |
 | ----------------------- | ------------------------ | -------------------------------------- |
 | `PORT`                  | `3000`                   | Site server port                       |
+| `HOST`                  | `0.0.0.0`                | Site server bind address               |
 | `PB_URL`                | `http://127.0.0.1:8090`  | PocketBase URL used by the site server |
-| `PB_DATA_DIR`           | `/data`                  | PocketBase data directory (volume)     |
+| `PB_DATA_DIR`           | `/app/pb_data`           | PocketBase data directory (volume)     |
 | `PB_SUPERUSER_EMAIL`    | —                        | Initial admin (bootstrapped at start)  |
 | `PB_SUPERUSER_PASSWORD` | —                        | Initial admin password                 |