Initial build: Great Bear microbrewery site

- TanStack Start (React 19, Tailwind 4) frontend recreated from Stitch design
- PocketBase backend with schema migration + idempotent content seed
- Single Docker image running both services (non-root, healthchecked)
- deploy.sh to build & push to registry.tanshu.com
- Ansible playbook (roles: app, caddy) deploying to www.greatbear.in
  with Caddy TLS entries for the site and the PocketBase admin

deploy.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+#
+# Build the Great Bear image and push it to the private registry.
+#
+# Reads registry credentials from the environment or from ./.env
+# (REGISTRY_USER, REGISTRY_PASSWORD). Optional overrides: REGISTRY,
+# IMAGE_NAME, PLATFORM.
+#
+set -euo pipefail
+cd "$(dirname "$0")"
+
+# shellcheck disable=SC1091
+[ -f .env ] && set -a && . ./.env && set +a
+
+REGISTRY="${REGISTRY:-registry.tanshu.com}"
+IMAGE_NAME="${IMAGE_NAME:-tanshu/greatbear}"
+REGISTRY_USER="${REGISTRY_USER:?REGISTRY_USER not set (define it in .env or the environment)}"
+REGISTRY_PASSWORD="${REGISTRY_PASSWORD:?REGISTRY_PASSWORD not set (define it in .env or the environment)}"
+PLATFORM="${PLATFORM:-linux/amd64}"
+
+IMAGE="$REGISTRY/$IMAGE_NAME"
+VERSION="$(git rev-parse --short HEAD 2>/dev/null || date +%Y%m%d%H%M%S)"
+
+echo "==> Building $IMAGE:$VERSION (and :latest) for $PLATFORM"
+docker build --platform "$PLATFORM" \
+  -t "$IMAGE:latest" \
+  -t "$IMAGE:$VERSION" \
+  .
+
+echo "==> Logging in to $REGISTRY"
+printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY" --username "$REGISTRY_USER" --password-stdin
+
+echo "==> Pushing $IMAGE:latest"
+docker push "$IMAGE:latest"
+echo "==> Pushing $IMAGE:$VERSION"
+docker push "$IMAGE:$VERSION"
+
+echo
+echo "Done. Deploy with:"
+echo "  cd ansible && ansible-playbook -i inventory/hosts.yml site.yml"