Model the build on mozimo and target emily

- Makefile: PLATFORMS, tags :<commit> and :main, build-check with --pull.
- deploy.sh: push, guards, git pull --ff-only, optional --prune, image_tag.
- Replace .containerignore with .dockerignore.
- Add the opt-in image prune to the hops role.
- Tag the Caddyfile task so --skip-tags caddy works before DNS cutover.
- Trim comments and rewrite build and deploy text in plain prose.

Dockerfile

@@ -1,8 +1,6 @@
 # syntax=docker/dockerfile:1
 
-# ------------------------------------------------------------------------------
-# Stage 1: Install frontend dependencies (Native execution on host architecture)
-# ------------------------------------------------------------------------------
+# Frontend dependencies. Runs on the build platform.
 FROM --platform=$BUILDPLATFORM node:lts-trixie-slim AS deps
 WORKDIR /app/frontend
 
@@ -10,9 +8,7 @@ COPY frontend/package.json frontend/package-lock.json* ./
 RUN --mount=type=cache,target=/root/.npm \
   npm ci
 
-# ------------------------------------------------------------------------------
-# Stage 2: Build the TanStack Start frontend (Native execution on host architecture)
-# ------------------------------------------------------------------------------
+# Frontend build. Runs on the build platform.
 FROM --platform=$BUILDPLATFORM node:lts-trixie-slim AS builder
 WORKDIR /app/frontend
 
@@ -22,9 +18,7 @@ COPY frontend/ ./
 ENV NODE_ENV=production
 RUN npm run build
 
-# ------------------------------------------------------------------------------
-# Stage 3: Fetch PocketBase binary for target architecture (Native host downloader)
-# ------------------------------------------------------------------------------
+# PocketBase binary for the target architecture. Runs on the build platform.
 FROM --platform=$BUILDPLATFORM alpine:3.20 AS pb-downloader
 ARG TARGETARCH
 ARG PB_VERSION=0.40.2
@@ -41,9 +35,7 @@ RUN apk add --no-cache curl unzip ca-certificates \
   && chmod +x /app/pocketbase \
   && rm -f /tmp/pb.zip
 
-# ------------------------------------------------------------------------------
-# Stage 4: Production runner (Target architecture)
-# ------------------------------------------------------------------------------
+# Runtime image. Runs on the target architecture.
 FROM node:lts-trixie-slim AS runner
 LABEL maintainer="Amritanshu <docker@tanshu.com>"
 
@@ -54,31 +46,22 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 WORKDIR /app
 
-# Copy PocketBase binary and migrations
 COPY --from=pb-downloader /app/pocketbase /app/pocketbase
 COPY backend/pb_migrations /app/pb_migrations
-
-# Copy compiled frontend application
 COPY --from=builder /app/frontend/.output /app/frontend/.output
-
-# Copy entrypoint script
 COPY docker-entrypoint.sh /app/docker-entrypoint.sh
 RUN chmod +x /app/docker-entrypoint.sh
 
-# Environment variables
 ENV NODE_ENV=production \
   PORT=3000 \
   HOST=0.0.0.0 \
   PB_DATA_DIR=/app/pb_data
 
-# Persistent data volume for PocketBase SQLite database and file storage
 VOLUME ["/app/pb_data"]
 
-# Port 3000: TanStack Start Web Application
-# Port 8090: PocketBase REST API & Admin UI
 EXPOSE 3000 8090
 
-# Health check for both PocketBase and frontend server
+# podman drops this when it builds an OCI image. The Quadlet unit repeats it.
 HEALTHCHECK --interval=15s --timeout=3s --start-period=5s --retries=3 \
   CMD curl -fsS http://127.0.0.1:8090/api/health > /dev/null && curl -fsS http://127.0.0.1:3000 > /dev/null || exit 1