Rebuild ansible on the project deploy template

- playbook.yml (hosts: monoco) + vars/default.yml, requirements.yml
- roles: network (shared docker network), greatbear (registry pull,
  bind mount /var/lib/greatbear/pb_data, .env upload, health wait),
  caddy (blockinfile snippet into the shared Caddyfile + docker exec reload)
- image honors PB_DATA_DIR and runs as root to match the bind-mount pattern
- frontend on www.greatbear.in (+apex) with /api/* and /_* proxied to
  PocketBase; admin.greatbear.in redirects to the admin UI

Dockerfile

@@ -25,8 +25,7 @@ ENV NODE_ENV=production \
 
 WORKDIR /app
 
-RUN apk add --no-cache curl unzip \
-  && addgroup -S app && adduser -S app -G app
+RUN apk add --no-cache curl unzip
 
 # Site server build output
 COPY --from=build /app/.output ./.output
@@ -49,11 +48,10 @@ RUN case "${TARGETARCH:-amd64}" in \
   && unzip -o /tmp/pb.zip pocketbase -d /app \
   && chmod +x /app/pocketbase \
   && rm /tmp/pb.zip \
-  && mkdir -p /data \
-  && chown -R app:app /app /data
+  && mkdir -p /app/pb_data
 
-USER app
-VOLUME /data
+# Runs as root so the Ansible-managed bind mount (/var/lib/greatbear/pb_data)
+# is writable regardless of host-side ownership.
 
 EXPOSE 3000 8090