Run the build on Podman and deploy as a rootless Podman Quadlet

- Makefile: podman build + push instead of docker buildx. build-production
  clones the git remote and builds from it; build-check / build-check-local
  build without pushing. Single-architecture (PLATFORM-overridable) rather
  than a multi-arch manifest.
- deploy.sh: connect as the unprivileged container user; no become.
- ansible: target emily, rootless Podman Quadlet behind the fleet's shared
  Caddy unit (caddy/playbook.yml in ansible-playbooks).
  - register role writes greatbear.network (NetworkName=greatbear_net) and
    the caddy.container.d drop-in that puts Caddy on it.
  - greatbear role: podman login/pull, ~/podman-data/greatbear + .env,
    greatbear.container (UserNS=keep-id:uid=0,gid=0, EnvironmentFile,
    Network, Volume, no published ports), systemctl --user start and a
    podman healthcheck gate, with a diagnostics rescue block.
  - caddy role appends the site blocks to the shared Caddyfile and reloads;
    handlers reload vs. recreate Caddy (a new network drop-in re-creates it).
  - drop the network role, the community.docker requirements and the
    ansible/files/ templates.
- .containerignore replaces .dockerignore (Buildah reads it natively).
- README: Podman build, rootless Quadlet deploy. No data migration step —
  there is no PocketBase state to carry over.

deploy.sh

@@ -5,7 +5,7 @@ parent_path=$( cd "$(dirname "${BASH_SOURCE[0]}")" || exit ; pwd -P )
 cd "$parent_path" || exit
 
 echo "========================================================"
-echo " Building & Uploading Docker Image"
+echo " Building & Uploading Container Image (Podman)"
 echo "========================================================"
 current_version="${1:-latest}"
 make build-production TAG="$current_version"
@@ -15,5 +15,9 @@ echo ""
 echo "========================================================"
 echo " Executing Ansible Deployment"
 echo "========================================================"
+# The play configures rootless Podman Quadlet units that belong to the
+# connecting user, so it must connect as that user and must NOT become root.
+# `-u` is the account that owns ~/.config/containers/systemd on the target.
+deploy_user="${ANSIBLE_USER:-tanshu}"
 cd "$parent_path/ansible" || exit
-ansible-playbook playbook.yml -e "tag=$current_version"
+ansible-playbook -u "$deploy_user" playbook.yml -e "tag=$current_version"