Deploy with rootless podman + Quadlet on emily

Retargets the build and the playbook off rootful Docker on monoco, following the
conventions already in place on emily's other services: Quadlet units in
~/.config/containers/systemd, per-service data in ~/podman-data, and a shared
Caddy that every service registers itself with — a network drop-in plus a
marked block in its Caddyfile. Nothing is published on the host; Caddy reaches
the containers by name over mozimo_net.

- Makefile: podman build + push instead of docker buildx, PLATFORMS=linux/arm64
  (both hosts are aarch64). podman has no built-in QEMU the way buildx's builder
  image does, so a foreign-platform failure now points at qemu-user-static.
- deploy.sh: pass COMMIT= to make, which the Makefile actually reads; it was
  passing TAG=, so the tag silently came from `git rev-parse` instead.
- ansible: hosts emily, become false, XDG_RUNTIME_DIR for rootless podman and
  systemctl --user. Docker modules become Quadlet templates with user-service
  handlers, and the network role now ships mozimo.network plus the Caddy drop-in
  rather than calling docker_network.
- UserNS=keep-id maps the container's uid 1000 (node) and root (vince) onto the
  host user, so PocketBase and Vince write host-owned files instead of
  subuid-owned ones; the play asserts the pinned uid still matches the host.
- ansible/README.md: the unit layout, the service-registration convention, and
  the monoco -> emily migration (PocketBase 23 MB + Vince 119 MB, DNS cutover,
  rollback).

Verified by a check-mode rehearsal against emily (13 ok / 8 changed / 0 failed)
and a disposable Quadlet unit on that host proving the uid mapping, the
EnvironmentFile and the isolated network. The real build and cutover have not
been run.

ansible/roles/network/tasks/main.yaml

@@ -1,8 +1,29 @@
 ---
-- name: Ensure 'mozimo' Docker network exists
-  docker_network:
-    name: "{{ docker_network }}"
-    state: present
-    connected:
-      - name: caddy
-    appends: yes
+# mozimo's own podman network, and its registration with the shared Caddy.
+#
+# This is how services register themselves on this host: the network is a
+# Quadlet unit, and Caddy joins it through a drop-in file rather than through
+# a global list of upstream networks. Deleting the drop-in removes Caddy from
+# the network on the next daemon-reload — the reverse of deployment.
+- name: Install the mozimo network Quadlet
+  ansible.builtin.template:
+    src: mozimo.network.j2
+    dest: "{{ quadlet_dir }}/{{ network_quadlet }}.network"
+    mode: "0644"
+  register: mozimo_network_unit
+  notify: Restart Caddy
+
+- name: Register the network with Caddy
+  ansible.builtin.template:
+    src: caddy-network.conf.j2
+    dest: "{{ caddy_dropin_dir }}/{{ caddy_dropin_file }}"
+    mode: "0644"
+  register: mozimo_caddy_dropin
+  notify: Restart Caddy
+
+# Caddy has to be on the network before the site block starts proxying to it,
+# otherwise the first requests after a reload are 502s. Restarting here also
+# flushes before the mozimo unit comes up.
+- name: Restart Caddy now if its network membership changed
+  ansible.builtin.meta: flush_handlers
+  when: mozimo_network_unit.changed or mozimo_caddy_dropin.changed