Initial build: Great Bear microbrewery site

- TanStack Start (React 19, Tailwind 4) frontend recreated from Stitch design
- PocketBase backend with schema migration + idempotent content seed
- Single Docker image running both services (non-root, healthchecked)
- deploy.sh to build & push to registry.tanshu.com
- Ansible playbook (roles: app, caddy) deploying to www.greatbear.in
  with Caddy TLS entries for the site and the PocketBase admin

ansible/roles/app/tasks/main.yml

@@ -0,0 +1,58 @@
+---
+# Pull the image from the private registry and (re)create the app container.
+- name: Log in to the private registry
+  community.docker.docker_login:
+    registry_url: "{{ registry_url }}"
+    username: "{{ registry_username }}"
+    password: "{{ registry_password }}"
+
+- name: Pull the application image
+  community.docker.docker_image:
+    name: "{{ app_image }}"
+    tag: "{{ app_image_tag }}"
+    source: pull
+    force_source: true
+
+- name: Run the application container
+  community.docker.docker_container:
+    name: "{{ app_container_name }}"
+    image: "{{ app_image }}:{{ app_image_tag }}"
+    state: started
+    recreate: true
+    restart_policy: unless-stopped
+    published_ports:
+      - "{{ app_site_publish }}"
+      - "{{ app_admin_publish }}"
+    volumes:
+      - "{{ app_volume_name }}:/data"
+    env:
+      PORT: "3000"
+      PB_URL: "http://127.0.0.1:8090"
+      PB_SUPERUSER_EMAIL: "{{ pb_superuser_email }}"
+      PB_SUPERUSER_PASSWORD: "{{ pb_superuser_password }}"
+    comparisons:
+      image: ignore   # recreate: true already handles image updates
+    container_default_behavior: compatibility
+
+- name: Wait for PocketBase to become healthy
+  ansible.builtin.uri:
+    url: http://127.0.0.1:8090/api/health
+    status_code: 200
+  register: pb_health
+  retries: 30
+  delay: 5
+  until: pb_health.status == 200
+
+- name: Wait for the site to respond
+  ansible.builtin.uri:
+    url: http://127.0.0.1:3000/
+    status_code: 200
+  register: site_health
+  retries: 30
+  delay: 5
+  until: site_health.status == 200
+
+- name: Log out of the private registry
+  community.docker.docker_login:
+    registry_url: "{{ registry_url }}"
+    state: absent