Move the deployment into the app repo, and build it with podman

The playbook, its roles, its vars and a new inventory now live in ansible/,
beside the app they deploy, the way the other apps on this machine are laid out.
The inventory follows the same shape: one entry per Site, all on the same box,
each naming its own vars file through var_file, so adding a Site is one line and
a file rather than a command-line flag. ansible_host is written as the
resolvable name rather than an ssh alias so the inventory works on any machine.

The image is now built with podman as a multi-arch manifest and pushed to
registry.tanshu.com/menu-admin, mirroring the Makefile used elsewhere on this
machine: build-production, plus build-check and build-check-local for a build
that does not push. deploy.sh runs the checks, builds, pushes, then runs the
playbook for the Site named by SITE, with SKIP_DEPLOY for a push without a
deploy.

ESLint comes out again: this project's typescript@7 has no JavaScript compiler
API, so typescript-eslint cannot install, and linting only the JavaScript was
not worth keeping. Prettier stays, and the README records why ESLint is absent
and what would bring it back.

deploy.sh

@@ -1,47 +1,45 @@
 #!/usr/bin/env bash
 #
-# Builds the image, runs the tests and pushes it to the private registry.
+# Builds the image with podman, pushes it to the private registry, then deploys
+# the Site with the playbook that lives in ansible/.
 #
-#   ./deploy.sh 2026-09-22
+#   ./deploy.sh 2026-09-22                  deploy the default Site
+#   SITE=greatbear ./deploy.sh 2026-09-22   deploy another Site
+#   SKIP_DEPLOY=1 ./deploy.sh 2026-09-22    build and push only
+#   SKIP_CHECKS=1 ./deploy.sh 2026-09-22    skip format, typecheck and tests
 #
-# Then deploy with the printed ansible-playbook command, or with the cutover
-# flags from deploy/ansible/readme.md.
 set -euo pipefail
 
 TAG="${1:-}"
 if [[ -z "$TAG" ]]; then
-  echo "usage: deploy.sh <tag>   (e.g. $(date +%Y-%m-%d) or a git short sha)" >&2
+  echo "usage: $0 <tag>   (e.g. $(date +%Y-%m-%d) or a git short sha)" >&2
   exit 1
 fi
 
-IMAGE="registry.tanshu.com/menu-admin:${TAG}"
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+parent_path=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)
+cd "$parent_path"
 
-cd "$ROOT"
+if ! command -v podman >/dev/null 2>&1; then
+  echo "podman is required to build and push the image" >&2
+  exit 1
+fi
 
-if [[ -z "${SKIP_TESTS:-}" ]]; then
-  echo "==> lint, format and tests"
-  npm run lint
+if [[ -z "${SKIP_CHECKS:-}" ]]; then
+  echo "==> format, types and tests"
   npm run format:check
   npm run typecheck
   npm test
 fi
 
-echo "==> building ${IMAGE}"
-docker build -t "$IMAGE" .
+echo "==> building and pushing registry.tanshu.com/menu-admin:$TAG"
+make build-production TAG="$TAG"
 
-echo "==> pushing ${IMAGE}"
-docker push "$IMAGE"
+if [[ -n "${SKIP_DEPLOY:-}" ]]; then
+  echo "SKIP_DEPLOY is set, so the playbook was not run."
+  exit 0
+fi
 
-cat <<EOF
-
-pushed ${IMAGE}
-
-parallel run:
-  ansible-playbook -l monoco -e site=hopsngrains -e tag=${TAG} playbook.yml
-
-cutover:
-  ansible-playbook -l monoco -e site=hopsngrains -e tag=${TAG} \\
-    -e vhost=menu.hopsngrains.com -e retire_nginx_snippet=true \\
-    -e retire_nginx_container=true playbook.yml
-EOF
+SITE="${SITE:-hopsngrains}"
+echo "==> deploying $SITE"
+cd ansible
+ansible-playbook --inventory=hosts playbook.yml --limit "$SITE" -e "tag=$TAG"