Add the playbook that deploys one Site

The playbook pulls the tag from the registry, creates the data root owned by the
app user, runs the container with its config baked into the image, waits for
health, then verifies the data directory as the app user so a permissions
mistake surfaces at deploy time. Caddy is pointed at the app with a stable
marker, so a temporary hostname can be checked beside the live site and the
cutover is one invocation with the retire flags set.

deploy/ansible/playbook.yml

@@ -0,0 +1,19 @@
+---
+# Deploys the menu app for one Site. Copy this directory to
+# ansible-playbooks/menu-admin/ and run it from there:
+#
+#   ansible-playbook -l monoco -e site=hopsngrains -e tag=<tag> playbook.yml
+#
+# The first run targets a temporary vhost (menu-new...) so the new site can be
+# checked against the live one. Cutover is the same playbook with the real vhost
+# and the two retire flags set; see readme.md.
+- hosts: all
+  become: true
+  vars_files:
+    - vars/default.yml
+    - "vars/{{ site }}.yml"
+
+  roles:
+    - network
+    - menu-app
+    - caddy