Deploy with rootless podman + Quadlet on emily

Retargets the build and the playbook off rootful Docker on monoco, following the
conventions already in place on emily's other services: Quadlet units in
~/.config/containers/systemd, per-service data in ~/podman-data, and a shared
Caddy that every service registers itself with — a network drop-in plus a
marked block in its Caddyfile. Nothing is published on the host; Caddy reaches
the containers by name over mozimo_net.

- Makefile: podman build + push instead of docker buildx, PLATFORMS=linux/arm64
  (both hosts are aarch64). podman has no built-in QEMU the way buildx's builder
  image does, so a foreign-platform failure now points at qemu-user-static.
- deploy.sh: pass COMMIT= to make, which the Makefile actually reads; it was
  passing TAG=, so the tag silently came from `git rev-parse` instead.
- ansible: hosts emily, become false, XDG_RUNTIME_DIR for rootless podman and
  systemctl --user. Docker modules become Quadlet templates with user-service
  handlers, and the network role now ships mozimo.network plus the Caddy drop-in
  rather than calling docker_network.
- UserNS=keep-id maps the container's uid 1000 (node) and root (vince) onto the
  host user, so PocketBase and Vince write host-owned files instead of
  subuid-owned ones; the play asserts the pinned uid still matches the host.
- ansible/README.md: the unit layout, the service-registration convention, and
  the monoco -> emily migration (PocketBase 23 MB + Vince 119 MB, DNS cutover,
  rollback).

Verified by a check-mode rehearsal against emily (13 ok / 8 changed / 0 failed)
and a disposable Quadlet unit on that host proving the uid mapping, the
EnvironmentFile and the isolated network. The real build and cutover have not
been run.

ansible/roles/caddy/handlers/main.yaml

@@ -1,5 +1,10 @@
 ---
-# Handlers for Caddy role
+# Handlers for the Caddy role.
+#
+# A reload, not a restart: only the site blocks changed, and Caddy reloads its
+# config in place without dropping the other services' connections. Network
+# membership changes are a restart and are handled by the network role.
 - name: Reload Caddy configuration
-  ansible.builtin.command: "docker exec -w /etc/caddy {{ caddy_container }} caddy reload"
-  listen: "Reload Caddy"
+  ansible.builtin.command: "podman exec -w /etc/caddy {{ caddy_container }} caddy reload"
+  changed_when: true
+  listen: "Reload Caddy"

ansible/roles/caddy/tasks/main.yaml

@@ -1,12 +1,17 @@
 ---
+# mozimo's block in the host's shared Caddyfile.
+#
+# This host's Caddy is shared and its Caddyfile is not templated: every service
+# owns a marked block in it, appended here, so a service can be removed without
+# touching anyone else's routing.
 - name: Read snippet from template
   ansible.builtin.set_fact:
     caddy_snippet_block: "{{ lookup('ansible.builtin.template', 'files/Caddyfile.j2') }}"
 
-- name: Install mozimo Caddy snippet (web + cms)
+- name: Install the mozimo Caddy snippet (web + cms + stats)
   ansible.builtin.blockinfile:
     path: "{{ caddyfile_path }}"
-    marker: "# {mark} Ansible managed Caddy snippet (mozimo web + cms)"
+    marker: "# {mark} Ansible managed Caddy snippet for {{ apex_host }}"
     block: "{{ caddy_snippet_block }}"
     insertafter: EOF
   notify: "Reload Caddy"