Menu Set store, image pipeline and Site config

The store keeps a Menu Set's state in the directory layout (drafts/ versus
published/) and its metadata in a manifest, with publishing as a single
directory rename. Editing is allowed on Drafts only, so a published menu can
never change under a customer. Stages 2 and 3 of docs/plan.md, with tests.

docs/adr/0004-one-app-instance-per-site.md

@@ -0,0 +1,5 @@
+# One app instance per Site
+
+The same app is deployed once per Site — hopsngrains, hngmohali and greatbear — each with its own configuration, admin password and data directory, rather than one instance serving all Sites with a Site dimension in its data model. The three menu deployments share a serving pattern but not their brands, Sections or content, and separate instances keep one Site's mistake away from the others.
+
+**Considered Options**: a single multi-Site app with Site above Section in the data model, rejected as a retrofit risk with no benefit at three Sites.