Run the Sites as rootless Podman Quadlets, and build with podman

The fleet on emily is rootless Podman with Quadlet units under
~/.config/containers/systemd and state in ~/podman-data, all behind one shared
Caddy unit. This brings the menus in line instead of leaving them the last
Docker deployment. The build moves with them: podman reads a Containerfile as
readily as a Dockerfile, so the name now says which toolchain is real.

The app is one .container and one .network file. Two details carry it.
UserNS=keep-id maps the image's own node account onto the user that owns the
units, so data/ and site.env stay owned by tanshu: plain tar backups, no
subuids. provision-site-env.sh writes site.env with the same mapping rather
than --user, which under rootless Podman would have produced a subuid-owned
file the app could not read. And the Site registers its own network with Caddy
by writing a drop-in beside caddy.container, so Caddy never lists its upstreams
and never changes when a Site is added. The unit keeps the Docker-era container
name for the scripts and muscle memory that look it up, while the Caddyfile
proxies to a dotless NetworkAlias, because a container name with dots in it is
a liability in DNS.

The unit keeps podman's Pull=missing, so a restart or a reboot never depends on
the registry being reachable, while the play pulls explicitly at deploy time.
That is also where a missing `podman login` for the private registry now fails,
with the instruction, rather than as a unit that will not start.

copy-site-data.sh moves a Site's data across, and is not a plain rsync:
/var/lib/menu.* on monoco belongs to uid 1000 while the ssh user there is 1001,
so the read needs sudo; monoco cannot ssh to emily, so the workstation relays
the tar; and the extraction runs as tanshu on emily, which is what makes the
files land owned by the user keep-id maps the app onto. It proves the copy by
comparing a SHA-256 of the whole tree against the source and checking every
file's owner.

Not yet done: the copies themselves and the DNS move, which need a human.

README.md

@@ -10,8 +10,9 @@ Built: Site config, the Menu Set store, the image pipeline, the customer-facing
 renderer (landing page, Section pages, archived sets, media route) with the
 approved design, the admin (sign in, create a set, upload and reorder Pages,
 preview, publish, restore, delete), the `verify`/`repair` CLI, the container and
-the Ansible playbook. Not yet done: the parallel-run deployment on `monoco`,
-which needs a human present.
+the Ansible deployment as rootless Podman Quadlet units on `emily`, behind the
+shared Caddy unit. Not yet done: copying each Site's data across from `monoco`
+and moving DNS, which needs a human present.
 
 ## Deploying
 
@@ -23,8 +24,10 @@ SKIP_DEPLOY=1 ./deploy.sh 2026-09-22   # build and push only
 The image is built with **podman** as a multi-arch manifest and pushed to
 `registry.tanshu.com/menu-admin` (`Makefile`, mirrored from the other apps on
 this machine). The Ansible deployment lives in `ansible/` in this repo, with one
-inventory entry per Site; see `ansible/readme.md` for how a deploy runs and how to
-roll one back.
+inventory entry per Site. It writes a rootless Podman **Quadlet** unit per Site
+and appends the Site's block to the shared Caddyfile, exactly as the sibling
+services in `ansible-playbooks` do; see `ansible/readme.md` for how a deploy runs
+and how to roll one back.
 
 ## Layout
 
@@ -47,11 +50,14 @@ test/                     node:test suites
 docs/plan.md              The agreed plan
 docs/operating.md         Publishing, fixing and rolling back, for whoever operates it
 docs/adr/                 Decisions worth remembering
-deploy.sh                 Tests, build, push
+Containerfile             The image, built by podman
+compose.yaml              Local dev: podman compose
+deploy.sh                 Tests, build, push, deploy
+ansible/                  The deployment: one rootless Quadlet unit per Site
 ```
 
-The Ansible playbook lives in `ansible-playbooks/menu-admin/`, beside the other
-playbooks, because that is where it is run from.
+The deployment is in `ansible/` here, beside the app it deploys, and is run from
+that directory by `deploy.sh`.
 
 ## Running it locally