Move the deployment into the app repo, and build it with podman

The playbook, its roles, its vars and a new inventory now live in ansible/,
beside the app they deploy, the way the other apps on this machine are laid out.
The inventory follows the same shape: one entry per Site, all on the same box,
each naming its own vars file through var_file, so adding a Site is one line and
a file rather than a command-line flag. ansible_host is written as the
resolvable name rather than an ssh alias so the inventory works on any machine.

The image is now built with podman as a multi-arch manifest and pushed to
registry.tanshu.com/menu-admin, mirroring the Makefile used elsewhere on this
machine: build-production, plus build-check and build-check-local for a build
that does not push. deploy.sh runs the checks, builds, pushes, then runs the
playbook for the Site named by SITE, with SKIP_DEPLOY for a push without a
deploy.

ESLint comes out again: this project's typescript@7 has no JavaScript compiler
API, so typescript-eslint cannot install, and linting only the JavaScript was
not worth keeping. Prettier stays, and the README records why ESLint is absent
and what would bring it back.

Makefile

@@ -0,0 +1,23 @@
+IMAGE ?= registry.tanshu.com/menu-admin
+PLATFORMS ?= linux/amd64,linux/arm64
+
+.PHONY: build-production build-check build-check-local
+
+# Mirrors the other apps on this machine: a podman manifest build, so one tag
+# carries both architectures, pushed to the private registry.
+build-production: ## Build and push the production image. Usage: make build-production TAG=2026-09-22
+	@test -n "$(TAG)" || { echo "Usage: make build-production TAG=2026-09-22" >&2; exit 1; }
+	@echo "Building image..."
+	@podman manifest rm $(IMAGE):latest 2>/dev/null || true
+	@podman build --platform $(PLATFORMS) --manifest $(IMAGE):latest --pull .
+	@echo "Pushing manifests..."
+	@podman manifest push --all $(IMAGE):latest docker://$(IMAGE):latest
+	@podman manifest push --all $(IMAGE):latest docker://$(IMAGE):$(TAG)
+
+build-check: ## Multi-arch build without pushing, to prove both platforms build
+	@podman manifest rm menu-admin:check 2>/dev/null || true
+	@podman build --platform $(PLATFORMS) --manifest menu-admin:check --pull .
+
+build-check-local: ## Single-arch build without pushing: the quick local check
+	@podman manifest rm menu-admin:check 2>/dev/null || true
+	@podman build --platform linux/amd64 --manifest menu-admin:check .