Run the build on Podman and deploy as a rootless Podman Quadlet

- Makefile: podman build + push instead of docker buildx. build-production
  clones the git remote and builds from it; build-check / build-check-local
  build without pushing. Single-architecture (PLATFORM-overridable) rather
  than a multi-arch manifest.
- deploy.sh: connect as the unprivileged container user; no become.
- ansible: target emily, rootless Podman Quadlet behind the fleet's shared
  Caddy unit (caddy/playbook.yml in ansible-playbooks).
  - register role writes greatbear.network (NetworkName=greatbear_net) and
    the caddy.container.d drop-in that puts Caddy on it.
  - greatbear role: podman login/pull, ~/podman-data/greatbear + .env,
    greatbear.container (UserNS=keep-id:uid=0,gid=0, EnvironmentFile,
    Network, Volume, no published ports), systemctl --user start and a
    podman healthcheck gate, with a diagnostics rescue block.
  - caddy role appends the site blocks to the shared Caddyfile and reloads;
    handlers reload vs. recreate Caddy (a new network drop-in re-creates it).
  - drop the network role, the community.docker requirements and the
    ansible/files/ templates.
- .containerignore replaces .dockerignore (Buildah reads it natively).
- README: Podman build, rootless Quadlet deploy. No data migration step —
  there is no PocketBase state to carry over.

ansible/playbook.yml

@@ -1,11 +1,36 @@
 ---
-- name: Deploy The Great Bear Microbrewery
-  hosts: monoco
-  become: true
+# The Great Bear — rootless Podman + Quadlet, behind the fleet's shared Caddy
+# unit (caddy/playbook.yml in the ansible-playbooks repo).
+#
+# Connects as the container user and runs everything as that user: the Quadlet
+# units belong to it, so the connection's PAM session is what makes
+# `systemctl --user` and `podman exec` work without any environment juggling.
+# There is deliberately no `become`: root-only prerequisites (Podman,
+# `loginctl enable-linger`, the low-port sysctl Caddy needs) belong to
+# caddy/playbook.yml, which must have run on this host first.
+#
+# gather_facts is required: podman_user, podman_data_dir and quadlet_dir are
+# derived from the user_id / user_dir facts.
+#
+# Run with: ansible-playbook -u tanshu playbook.yml
+- name: Deploy The Great Bear as a rootless Podman Quadlet
+  hosts: emily
+  gather_facts: true
   vars_files:
     - vars/default.yml
 
+  pre_tasks:
+    # This must happen before the app unit is started, not after: the generated
+    # greatbear.container references {{ network_name }}.network, and Quadlet
+    # fails *unit generation* (so `systemctl --user start` reports "unit not
+    # found") when a referenced .network file does not exist yet. The same
+    # include writes the drop-in that attaches the shared Caddy unit to this
+    # network, which is what makes `greatbear` resolvable to Caddy.
+    - name: Register The Great Bear's network with Caddy
+      ansible.builtin.include_tasks: "{{ playbook_dir }}/roles/register/tasks/main.yaml"
+
   roles:
-    - network
+    # The app: data directory, .env, the Quadlet unit, start + healthcheck.
     - greatbear
+    # Appends this site's blocks to the shared Caddyfile and reloads Caddy.
     - caddy