Move the deployment into the app repo, and build it with podman

The playbook, its roles, its vars and a new inventory now live in ansible/,
beside the app they deploy, the way the other apps on this machine are laid out.
The inventory follows the same shape: one entry per Site, all on the same box,
each naming its own vars file through var_file, so adding a Site is one line and
a file rather than a command-line flag. ansible_host is written as the
resolvable name rather than an ssh alias so the inventory works on any machine.

The image is now built with podman as a multi-arch manifest and pushed to
registry.tanshu.com/menu-admin, mirroring the Makefile used elsewhere on this
machine: build-production, plus build-check and build-check-local for a build
that does not push. deploy.sh runs the checks, builds, pushes, then runs the
playbook for the Site named by SITE, with SKIP_DEPLOY for a push without a
deploy.

ESLint comes out again: this project's typescript@7 has no JavaScript compiler
API, so typescript-eslint cannot install, and linting only the JavaScript was
not worth keeping. Prettier stays, and the README records why ESLint is absent
and what would bring it back.

ansible/playbook.yml

@@ -0,0 +1,25 @@
+---
+# Deploys the menu app for one or more Sites. It lives here, beside the app it
+# deploys, and is run from this directory:
+#
+#   make build-production TAG=<tag>        (from the repo root)
+#   ansible-playbook --inventory=hosts playbook.yml --limit hopsngrains
+#
+# The first run targets a temporary vhost (menu-new...) so the new site can be
+# checked against the live one. Cutover is the same playbook with the real vhost
+# and the two retire flags set; see readme.md.
+- hosts: menus
+  become: true
+  vars_files:
+    - vars/default.yml
+
+  pre_tasks:
+    - name: Load the vars file this Site names in the inventory
+      ansible.builtin.include_vars:
+        file: '{{ var_file }}'
+      when: var_file is defined
+
+  roles:
+    - network
+    - menu-app
+    - caddy