Deploy with rootless podman + Quadlet on emily

Retargets the build and the playbook off rootful Docker on monoco, following the
conventions already in place on emily's other services: Quadlet units in
~/.config/containers/systemd, per-service data in ~/podman-data, and a shared
Caddy that every service registers itself with — a network drop-in plus a
marked block in its Caddyfile. Nothing is published on the host; Caddy reaches
the containers by name over mozimo_net.

- Makefile: podman build + push instead of docker buildx, PLATFORMS=linux/arm64
  (both hosts are aarch64). podman has no built-in QEMU the way buildx's builder
  image does, so a foreign-platform failure now points at qemu-user-static.
- deploy.sh: pass COMMIT= to make, which the Makefile actually reads; it was
  passing TAG=, so the tag silently came from `git rev-parse` instead.
- ansible: hosts emily, become false, XDG_RUNTIME_DIR for rootless podman and
  systemctl --user. Docker modules become Quadlet templates with user-service
  handlers, and the network role now ships mozimo.network plus the Caddy drop-in
  rather than calling docker_network.
- UserNS=keep-id maps the container's uid 1000 (node) and root (vince) onto the
  host user, so PocketBase and Vince write host-owned files instead of
  subuid-owned ones; the play asserts the pinned uid still matches the host.
- ansible/README.md: the unit layout, the service-registration convention, and
  the monoco -> emily migration (PocketBase 23 MB + Vince 119 MB, DNS cutover,
  rollback).

Verified by a check-mode rehearsal against emily (13 ok / 8 changed / 0 failed)
and a disposable Quadlet unit on that host proving the uid mapping, the
EnvironmentFile and the isolated network. The real build and cutover have not
been run.

ansible/playbook.yml

@@ -1,15 +1,34 @@
 #################################################
-# DO Community Playbooks: Docker
+# mozimo — rootless Podman + Quadlet deployment
 #################################################
 ---
-- hosts: monoco
-  become: true
+# Everything runs unprivileged as the ssh user: the containers are systemd
+# *user* services generated from Quadlet units, and Caddy is the host's shared
+# reverse proxy, which each service registers itself with (a network drop-in
+# plus a block in its Caddyfile).
+#
+#   ansible-playbook playbook.yml -e image_tag=<commit>
+#
+# Before DNS points at this host, skip the Caddy role — appending the site
+# block makes Caddy try to issue certificates for a name that still resolves
+# elsewhere (it retries, but the log is noisy):
+#
+#   ansible-playbook playbook.yml -e image_tag=<commit> --skip-tags caddy
+- hosts: emily
+  become: false
+  gather_facts: true
   vars_files:
     - vars/default.yml
 
+  environment:
+    # rootless podman and `systemctl --user` both need the user's runtime
+    # directory, and an ansible ssh session has no login session to set it.
+    XDG_RUNTIME_DIR: "{{ xdg_runtime_dir }}"
+
   roles:
     - upload
     - network
-    - analytics
     - mozimo
-    - caddy
+    - analytics
+    - role: caddy
+      tags: [caddy]