Move the deployment into the app repo, and build it with podman

The playbook, its roles, its vars and a new inventory now live in ansible/,
beside the app they deploy, the way the other apps on this machine are laid out.
The inventory follows the same shape: one entry per Site, all on the same box,
each naming its own vars file through var_file, so adding a Site is one line and
a file rather than a command-line flag. ansible_host is written as the
resolvable name rather than an ssh alias so the inventory works on any machine.

The image is now built with podman as a multi-arch manifest and pushed to
registry.tanshu.com/menu-admin, mirroring the Makefile used elsewhere on this
machine: build-production, plus build-check and build-check-local for a build
that does not push. deploy.sh runs the checks, builds, pushes, then runs the
playbook for the Site named by SITE, with SKIP_DEPLOY for a push without a
deploy.

ESLint comes out again: this project's typescript@7 has no JavaScript compiler
API, so typescript-eslint cannot install, and linting only the JavaScript was
not worth keeping. Prettier stays, and the README records why ESLint is absent
and what would bring it back.

ansible/vars/default.yml

@@ -0,0 +1,29 @@
+---
+# Defaults shared by every Site. Each Site's own file is named by the `var_file`
+# in ansible/hosts, and its slug is its inventory name.
+
+# Which Site config inside the image to run, and therefore which vhost it is
+# for. The file lives in the app repo at config/<site>.site.json.
+site: '{{ inventory_hostname }}'
+
+image_name: registry.tanshu.com/menu-admin
+image_tag: "{{ tag | default('latest') }}"
+
+# The hostname Caddy serves this Site on. The parallel run uses a temporary
+# name; cutover points the real one at the app.
+vhost: '{{ host }}'
+
+# Cutover switches. Both stay off until the parallel run has been checked.
+retire_nginx_snippet: false
+retire_nginx_container: false
+
+app_uid: 1000
+app_gid: 1000
+
+caddy_container: caddy
+caddyfile_path: /var/lib/caddy/conf/Caddyfile
+
+caddy_snippet: |
+  {{ vhost }} {
+      reverse_proxy {{ docker_container }}:3000
+  }

ansible/vars/hopsngrains.yml

@@ -0,0 +1,18 @@
+---
+# Hops n Grains. The name, icon, categories and theme live in the app repo
+# (config/hopsngrains.site.json seeds the theme and `data/` holds the rest), so
+# this file only says where to run it.
+host: menu.hopsngrains.com
+
+docker_container: menu-app.hopsngrains.com
+docker_network: '{{ docker_container }}_net'
+
+# First deployment: a temporary hostname beside the existing site.
+vhost: menu-new.hopsngrains.com
+
+# Everything the app writes — data/ and the untracked site.env.
+app_root: /var/lib/menu-app.hopsngrains.com
+
+# The old nginx container serving /var/lib/menu.hopsngrains.com. Left alone
+# until cutover.
+legacy_container: nginx-menu.hopsngrains.com