Build with Podman and deploy as a rootless Quadlet on emily

- Makefile: podman build/push from the committed tree (git archive HEAD),
  tagged :<commit> + :latest; PLATFORM defaults to linux/arm64 for emily.
- deploy.sh: push the commit first, refuse a dirty tracked tree or
  HEAD != origin/main, then build and deploy that exact commit via
  -e image_tag (rollback = an older commit).
- ansible: target emily with no become. The register role writes hops.network
  (NetworkName=hops_net) plus the caddy.container.d drop-in; the hops role
  installs ~/podman-data/hops and hops.container under systemctl --user with a
  podman healthcheck gate; the caddy role appends the site blocks to the shared
  Caddyfile and reloads.
- Drop the Docker-era network role, community.docker requirements,
  ansible/files templates and docker-compose.yml.
- .containerignore replaces .dockerignore.
- README: Podman build, rootless Quadlet deploy on emily.

ansible/playbook.yml

@@ -1,11 +1,36 @@
 ---
-- name: Deploy Hops n Grains Microbrewery
-  hosts: monoco
-  become: true
+# Hops n Grains — rootless Podman + Quadlet, behind the fleet's shared Caddy
+# unit (caddy/playbook.yml in the ansible-playbooks repo).
+#
+# Connects as the container user and runs everything as that user: the Quadlet
+# units belong to it, so the connection's PAM session is what makes
+# `systemctl --user` and `podman exec` work without any environment juggling.
+# There is deliberately no `become`: root-only prerequisites (Podman,
+# `loginctl enable-linger`, the low-port sysctl Caddy needs) belong to
+# caddy/playbook.yml, which must have run on this host first.
+#
+# gather_facts is required: podman_user, podman_data_dir and quadlet_dir are
+# derived from the user_id / user_dir facts.
+#
+# Run with: ansible-playbook -u tanshu playbook.yml
+- name: Deploy Hops n Grains as a rootless Podman Quadlet
+  hosts: emily
+  gather_facts: true
   vars_files:
     - vars/default.yml
 
+  pre_tasks:
+    # This must happen before the app unit is started, not after: the generated
+    # hops.container references {{ network_name }}.network, and Quadlet fails
+    # *unit generation* (so `systemctl --user start` reports "unit not found")
+    # when a referenced .network file does not exist yet. The same include
+    # writes the drop-in that attaches the shared Caddy unit to this network,
+    # which is what makes `hops` resolvable to Caddy.
+    - name: Register Hops n Grains' network with Caddy
+      ansible.builtin.include_tasks: "{{ playbook_dir }}/roles/register/tasks/main.yaml"
+
   roles:
-    - network
+    # The app: data directory, .env, the Quadlet unit, start + healthcheck.
     - hops
+    # Appends this site's blocks to the shared Caddyfile and reloads Caddy.
     - caddy