Move the deployment into the app repo, and build it with podman

The playbook, its roles, its vars and a new inventory now live in ansible/,
beside the app they deploy, the way the other apps on this machine are laid out.
The inventory follows the same shape: one entry per Site, all on the same box,
each naming its own vars file through var_file, so adding a Site is one line and
a file rather than a command-line flag. ansible_host is written as the
resolvable name rather than an ssh alias so the inventory works on any machine.

The image is now built with podman as a multi-arch manifest and pushed to
registry.tanshu.com/menu-admin, mirroring the Makefile used elsewhere on this
machine: build-production, plus build-check and build-check-local for a build
that does not push. deploy.sh runs the checks, builds, pushes, then runs the
playbook for the Site named by SITE, with SKIP_DEPLOY for a push without a
deploy.

ESLint comes out again: this project's typescript@7 has no JavaScript compiler
API, so typescript-eslint cannot install, and linting only the JavaScript was
not worth keeping. Prettier stays, and the README records why ESLint is absent
and what would bring it back.

ansible/roles/caddy/handlers/main.yaml

@@ -0,0 +1,6 @@
+---
+- name: Reload Caddy
+  # Caddy validates before it applies, so a mistake here leaves the running
+  # config untouched and fails the play loudly.
+  command: 'docker exec -w /etc/caddy {{ caddy_container }} caddy reload'
+  listen: Reload Caddy

ansible/roles/caddy/tasks/main.yaml

@@ -0,0 +1,39 @@
+---
+- name: Check the Caddyfile exists
+  stat:
+    path: '{{ caddyfile_path }}'
+  register: menu_caddyfile
+
+- name: Fail when Caddy is not where we expect it
+  fail:
+    msg: >-
+      {{ caddyfile_path }} is missing. Deploy the caddy playbook (which owns the
+      Caddy container and its config) before this one.
+  when: not menu_caddyfile.stat.exists
+
+# blockinfile replaces whatever sits between its markers, so changing `vhost`
+# updates the snippet in place. The sibling nginx-menu role only appended a
+# block when its exact text was absent, which cannot change a proxy target.
+- name: Point Caddy at the app
+  blockinfile:
+    path: '{{ caddyfile_path }}'
+    marker: '# {mark} ANSIBLE MANAGED: menu app ({{ site }})'
+    block: '{{ caddy_snippet }}'
+    create: no
+  notify: Reload Caddy
+
+- name: Remove the snippet the nginx-menu playbook wrote for this vhost
+  # A different marker, written by a different role. Leaving it in place would
+  # leave Caddy with two blocks for the same hostname.
+  blockinfile:
+    path: '{{ caddyfile_path }}'
+    marker: '# {mark} Ansible managed Caddy snippet for {{ host }}'
+    state: absent
+  when: retire_nginx_snippet | bool
+  notify: Reload Caddy
+
+- name: Stop the old nginx container
+  docker_container:
+    name: '{{ legacy_container }}'
+    state: stopped
+  when: retire_nginx_container | bool