Initial build: Great Bear microbrewery site

- TanStack Start (React 19, Tailwind 4) frontend recreated from Stitch design
- PocketBase backend with schema migration + idempotent content seed
- Single Docker image running both services (non-root, healthchecked)
- deploy.sh to build & push to registry.tanshu.com
- Ansible playbook (roles: app, caddy) deploying to www.greatbear.in
  with Caddy TLS entries for the site and the PocketBase admin

Dockerfile

@@ -0,0 +1,63 @@
+# syntax=docker/dockerfile:1
+# The Great Bear — single image running TanStack Start (site) + PocketBase (CMS/API)
+
+ARG NODE_VERSION=22
+ARG PB_VERSION=0.40.2
+
+# ---------- Stage 1: build the TanStack Start app ----------
+FROM node:${NODE_VERSION}-alpine AS build
+WORKDIR /app
+
+COPY app/package.json app/package-lock.json ./
+RUN npm ci --no-audit --no-fund
+
+COPY app/ ./
+RUN npm run build
+
+# ---------- Stage 2: runtime ----------
+FROM node:${NODE_VERSION}-alpine AS runtime
+ARG PB_VERSION
+ARG TARGETARCH
+
+ENV NODE_ENV=production \
+    PORT=3000 \
+    PB_URL=http://127.0.0.1:8090
+
+WORKDIR /app
+
+RUN apk add --no-cache curl unzip \
+  && addgroup -S app && adduser -S app -G app
+
+# Site server build output
+COPY --from=build /app/.output ./.output
+
+# Content seed (shared with the frontend fallback) + process supervisor
+COPY app/src/data/content.json ./scripts/content.json
+COPY scripts/seed.mjs scripts/run-all.mjs ./scripts/
+
+# PocketBase schema migrations
+COPY pb/migrations ./pb_migrations
+RUN mkdir -p pb_public
+
+# PocketBase binary (static Go binary, runs fine on Alpine)
+RUN case "${TARGETARCH:-amd64}" in \
+      arm64) PB_ARCH=arm64 ;; \
+      *) PB_ARCH=amd64 ;; \
+    esac \
+  && curl -fsSL -o /tmp/pb.zip \
+      "https://github.com/pocketbase/pocketbase/releases/download/v${PB_VERSION}/pocketbase_${PB_VERSION}_linux_${PB_ARCH}.zip" \
+  && unzip -o /tmp/pb.zip pocketbase -d /app \
+  && chmod +x /app/pocketbase \
+  && rm /tmp/pb.zip \
+  && mkdir -p /data \
+  && chown -R app:app /app /data
+
+USER app
+VOLUME /data
+
+EXPOSE 3000 8090
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=5 \
+  CMD curl -fsS http://127.0.0.1:8090/api/health -o /dev/null || exit 1
+
+CMD ["node", "scripts/run-all.mjs"]