Deploy with rootless podman + Quadlet on emily

Retargets the build and the playbook off rootful Docker on monoco, following the
conventions already in place on emily's other services: Quadlet units in
~/.config/containers/systemd, per-service data in ~/podman-data, and a shared
Caddy that every service registers itself with — a network drop-in plus a
marked block in its Caddyfile. Nothing is published on the host; Caddy reaches
the containers by name over mozimo_net.

- Makefile: podman build + push instead of docker buildx, PLATFORMS=linux/arm64
  (both hosts are aarch64). podman has no built-in QEMU the way buildx's builder
  image does, so a foreign-platform failure now points at qemu-user-static.
- deploy.sh: pass COMMIT= to make, which the Makefile actually reads; it was
  passing TAG=, so the tag silently came from `git rev-parse` instead.
- ansible: hosts emily, become false, XDG_RUNTIME_DIR for rootless podman and
  systemctl --user. Docker modules become Quadlet templates with user-service
  handlers, and the network role now ships mozimo.network plus the Caddy drop-in
  rather than calling docker_network.
- UserNS=keep-id maps the container's uid 1000 (node) and root (vince) onto the
  host user, so PocketBase and Vince write host-owned files instead of
  subuid-owned ones; the play asserts the pinned uid still matches the host.
- ansible/README.md: the unit layout, the service-registration convention, and
  the monoco -> emily migration (PocketBase 23 MB + Vince 119 MB, DNS cutover,
  rollback).

Verified by a check-mode rehearsal against emily (13 ok / 8 changed / 0 failed)
and a disposable Quadlet unit on that host proving the uid mapping, the
EnvironmentFile and the isolated network. The real build and cutover have not
been run.

README.md

@@ -69,13 +69,21 @@ npm run lint      # eslint (currently broken: leftover Next.js config)
 Copy `.env.example` to `.env` and fill in the Shopify Storefront token and
 PocketBase superuser credentials (`.env*` is gitignored).
 
-## Docker
+## Containers
+
+The image is built with **podman** (`podman build` reads the same `Dockerfile`):
 
 ```bash
-docker build -t mozimo-web .
-docker run -p 3000:3000 -p 8090:8090 -v mozimo_pb_data:/app/pb_data mozimo-web
+podman build -t mozimo-web .
+podman run -p 3000:3000 -p 8090:8090 -v mozimo_pb_data:/app/pb_data mozimo-web
 ```
 
+Production is **rootless podman + Quadlet** on the host `emily`: systemd user
+services generated from `.container` units, fronted by that host's shared
+Caddy. `./deploy.sh` builds the pushed commit with `make build-production` and
+runs `ansible/playbook.yml`. See [`ansible/README.md`](ansible/README.md) for
+the unit layout and the monoco → emily migration.
+
 Three-stage build (`deps → builder → runner`) on pinned `node:26-trixie-slim`:
 dependencies install with `npm ci` and BuildKit cache mounts, the final image
 runs as the unprivileged `node` user, ships production dependencies, the build
@@ -83,4 +91,5 @@ output, PocketBase v0.40.2 (multi-arch) and `entrypoint.sh` which starts both
 processes, ensures the PocketBase superuser matches `PB_SUPERUSER_EMAIL` /
 `PB_SUPERUSER_PASSWORD` on every boot, and seeds the CMS schema + defaults.
 Volumes: `/app/pb_data` holds the CMS database — back it up. Ports: `3000`
-web, `8090` PocketBase (`cms.mozimo.in` → 8090 via Caddy, see `ansible/`).
+web, `8090` PocketBase (both reached by Caddy over the podman network, not
+published on the host; see [`ansible/`](ansible/)).