Initial build: Great Bear microbrewery site

- TanStack Start (React 19, Tailwind 4) frontend recreated from Stitch design
- PocketBase backend with schema migration + idempotent content seed
- Single Docker image running both services (non-root, healthchecked)
- deploy.sh to build & push to registry.tanshu.com
- Ansible playbook (roles: app, caddy) deploying to www.greatbear.in
  with Caddy TLS entries for the site and the PocketBase admin

ansible/group_vars/greatbear/vars.yml

@@ -0,0 +1,31 @@
+---
+# Deployment variables for The Great Bear.
+# NOTE: This file contains credentials. For anything beyond a private homelab
+# repo, encrypt it with:  ansible-vault encrypt group_vars/greatbear/vars.yml
+
+# --- Domains (Caddy provisions TLS for both automatically) ---
+site_domain: www.greatbear.in
+admin_domain: admin.greatbear.in
+
+# --- Container image ---
+registry_url: registry.tanshu.com
+registry_username: ta-registry
+registry_password: ff28a01f00c0f39315d94cd9dcb1e554968dba25676a8ea5f2be34e96a9a099f
+app_image: registry.tanshu.com/tanshu/greatbear
+app_image_tag: latest
+
+# --- Container runtime ---
+app_container_name: greatbear
+app_volume_name: greatbear_pb_data
+# Ports are bound to loopback only; Caddy proxies public traffic to them.
+app_site_publish: 127.0.0.1:3000:3000
+app_admin_publish: 127.0.0.1:8090:8090
+
+# --- PocketBase initial admin (idempotent bootstrap on container start) ---
+pb_superuser_email: admin@greatbear.in
+pb_superuser_password: GreatBear!Admin2024
+
+# --- Caddy ---
+caddy_config_dir: /etc/caddy/caddy.d
+caddyfile_path: /etc/caddy/Caddyfile
+caddy_service: caddy