Build with Podman and deploy as a rootless Quadlet on emily

- Makefile: podman build/push from the committed tree (git archive HEAD),
  tagged :<commit> + :latest; PLATFORM defaults to linux/arm64 for emily.
- deploy.sh: push the commit first, refuse a dirty tracked tree or
  HEAD != origin/main, then build and deploy that exact commit via
  -e image_tag (rollback = an older commit).
- ansible: target emily with no become. The register role writes hops.network
  (NetworkName=hops_net) plus the caddy.container.d drop-in; the hops role
  installs ~/podman-data/hops and hops.container under systemctl --user with a
  podman healthcheck gate; the caddy role appends the site blocks to the shared
  Caddyfile and reloads.
- Drop the Docker-era network role, community.docker requirements,
  ansible/files templates and docker-compose.yml.
- .containerignore replaces .dockerignore.
- README: Podman build, rootless Quadlet deploy on emily.

ansible/roles/register/tasks/main.yaml

@@ -0,0 +1,67 @@
+---
+# Register Hops n Grains' network with the shared Caddy unit.
+#
+# Caddy is the base unit (caddy/playbook.yml in the ansible-playbooks repo) and
+# knows nothing about its upstreams. A service adds itself by writing two files
+# into the Quadlet directory:
+#
+#   1. its own hops.network unit, and
+#   2. a drop-in next to caddy.container that pulls that network into Caddy.
+#
+# This mirrors ansible-playbooks/caddy/roles/register/tasks/main.yaml, vendored
+# so this repo's deploy.sh stands on its own. Keep the bytes in sync with it.
+#
+# Included from playbook.yml's pre_tasks, before the app unit is generated. Runs
+# as the connection user, which must be {{ podman_user }}.
+
+- name: Ensure the Quadlet directory exists
+  ansible.builtin.file:
+    path: "{{ quadlet_dir }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: '0755'
+
+- name: "Create the {{ network_name }} network unit"
+  ansible.builtin.copy:
+    dest: "{{ quadlet_dir }}/{{ network_name }}.network"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: '0644'
+    content: |
+      # {{ network_name }} — logical app network.
+      # Managed by Ansible. Do not edit by hand.
+      #
+      # NetworkName pins the Podman network name. Without it Quadlet would
+      # create "systemd-{{ network_name }}".
+      #
+      # isolate blocks traffic between separate Podman networks, so a container
+      # on this network cannot reach one that is only on another. Caddy still
+      # reaches it, because it is a member of it.
+      [Network]
+      NetworkName={{ network_name }}_net
+      Options=isolate=true
+  notify: Restart Caddy
+
+- name: Ensure the Caddy Quadlet drop-in directory exists
+  ansible.builtin.file:
+    path: "{{ quadlet_dir }}/{{ caddy_name }}.container.d"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: '0755'
+
+- name: "Register {{ network_name }} with Caddy"
+  ansible.builtin.copy:
+    dest: "{{ quadlet_dir }}/{{ caddy_name }}.container.d/50-{{ network_name }}.conf"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: '0644'
+    content: |
+      # Added by Hops n Grains' playbook. Do not edit by hand.
+      #
+      # Quadlet merges this into caddy.container. Deleting this file removes
+      # the network from Caddy on the next daemon-reload.
+      [Container]
+      Network={{ network_name }}.network
+  notify: Restart Caddy