Menu Set store, image pipeline and Site config

The store keeps a Menu Set's state in the directory layout (drafts/ versus
published/) and its metadata in a manifest, with publishing as a single
directory rename. Editing is allowed on Drafts only, so a published menu can
never change under a customer. Stages 2 and 3 of docs/plan.md, with tests.

docs/adr/0001-app-serves-menus-instead-of-nginx.md

@@ -0,0 +1,5 @@
+# Menus are served by the app, not by nginx
+
+Each Site's `nginx:alpine` container and its read-only bind mount are retired: the app renders the menu HTML and serves the images itself, with Caddy reverse-proxying `menu.<site>` to it. The read-only mount was the reason menus could only be changed by `scp`, and keeping a file server alongside a dynamic renderer would leave two views of one directory free to drift.
+
+**Considered Options**: a hybrid where Caddy routes HTML to the app and image paths to nginx; and an app that renders HTML only and proxies image bytes to nginx. Both were rejected for preserving a second moving part whose only job is reading files the app already owns.