Run the build on Podman and deploy as a rootless Podman Quadlet

- Makefile: podman build + push instead of docker buildx. build-production
  clones the git remote and builds from it; build-check / build-check-local
  build without pushing. Single-architecture (PLATFORM-overridable) rather
  than a multi-arch manifest.
- deploy.sh: connect as the unprivileged container user; no become.
- ansible: target emily, rootless Podman Quadlet behind the fleet's shared
  Caddy unit (caddy/playbook.yml in ansible-playbooks).
  - register role writes greatbear.network (NetworkName=greatbear_net) and
    the caddy.container.d drop-in that puts Caddy on it.
  - greatbear role: podman login/pull, ~/podman-data/greatbear + .env,
    greatbear.container (UserNS=keep-id:uid=0,gid=0, EnvironmentFile,
    Network, Volume, no published ports), systemctl --user start and a
    podman healthcheck gate, with a diagnostics rescue block.
  - caddy role appends the site blocks to the shared Caddyfile and reloads;
    handlers reload vs. recreate Caddy (a new network drop-in re-creates it).
  - drop the network role, the community.docker requirements and the
    ansible/files/ templates.
- .containerignore replaces .dockerignore (Buildah reads it natively).
- README: Podman build, rootless Quadlet deploy. No data migration step —
  there is no PocketBase state to carry over.

ansible/roles/caddy/tasks/main.yaml

@@ -1,26 +1,22 @@
 ---
-- name: Read snippet from template file
-  ansible.builtin.set_fact:
-    caddy_snippet_block: "{{ lookup('template', 'files/Caddyfile.j2') }}"
+# Append The Great Bear's site blocks to the shared Caddyfile.
+#
+# The Caddyfile is a bind mount into the Caddy container, so Caddy sees the
+# change as soon as the file is written; the handler only asks Caddy to re-read
+# it. That is a reload, not a restart, so the other hosted sites are untouched.
+#
+# blockinfile is idempotent on its own via the marker, so there is no need to
+# slurp the file and compare first — which also matters because slurp *fails*
+# when the Caddyfile does not exist yet, on a host where caddy/playbook.yml has
+# not run.
 
-- name: Read current Caddyfile
-  ansible.builtin.slurp:
-    path: "{{ caddy_caddyfile_path }}"
-  register: caddy_caddyfile_raw
-
-- name: Decode Caddyfile content
-  ansible.builtin.set_fact:
-    caddy_caddyfile_content: "{{ caddy_caddyfile_raw['content'] | b64decode }}"
-
-- name: Check if snippet already exists
-  ansible.builtin.set_fact:
-    caddy_snippet_present: "{{ caddy_snippet_block in caddy_caddyfile_content }}"
-
-- name: Add or update snippet in Caddyfile
+- name: "Add the {{ host }} site blocks to the Caddyfile"
   ansible.builtin.blockinfile:
-    path: "{{ caddy_caddyfile_path }}"
+    path: "{{ caddyfile_path }}"
     marker: "# {mark} Ansible managed Caddy snippet for {{ host }}"
-    block: "{{ caddy_snippet_block }}"
+    block: "{{ snippet_block }}"
     create: true
-    mode: "0644"
-  notify: Reload Caddy configuration
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: '0644'
+  notify: Reload Caddy