Deploy with rootless podman + Quadlet on emily

Retargets the build and the playbook off rootful Docker on monoco, following the
conventions already in place on emily's other services: Quadlet units in
~/.config/containers/systemd, per-service data in ~/podman-data, and a shared
Caddy that every service registers itself with — a network drop-in plus a
marked block in its Caddyfile. Nothing is published on the host; Caddy reaches
the containers by name over mozimo_net.

- Makefile: podman build + push instead of docker buildx, PLATFORMS=linux/arm64
  (both hosts are aarch64). podman has no built-in QEMU the way buildx's builder
  image does, so a foreign-platform failure now points at qemu-user-static.
- deploy.sh: pass COMMIT= to make, which the Makefile actually reads; it was
  passing TAG=, so the tag silently came from `git rev-parse` instead.
- ansible: hosts emily, become false, XDG_RUNTIME_DIR for rootless podman and
  systemctl --user. Docker modules become Quadlet templates with user-service
  handlers, and the network role now ships mozimo.network plus the Caddy drop-in
  rather than calling docker_network.
- UserNS=keep-id maps the container's uid 1000 (node) and root (vince) onto the
  host user, so PocketBase and Vince write host-owned files instead of
  subuid-owned ones; the play asserts the pinned uid still matches the host.
- ansible/README.md: the unit layout, the service-registration convention, and
  the monoco -> emily migration (PocketBase 23 MB + Vince 119 MB, DNS cutover,
  rollback).

Verified by a check-mode rehearsal against emily (13 ok / 8 changed / 0 failed)
and a disposable Quadlet unit on that host proving the uid mapping, the
EnvironmentFile and the isolated network. The real build and cutover have not
been run.

ansible/roles/upload/tasks/main.yaml

@@ -1,11 +1,34 @@
 ---
-# Tasks for upload role
-- name: Ensure Host Directory exists
-  file:
-    path: "{{ host_directory }}"
-    state: directory
+# The service's directories and its runtime environment file.
+#
+# The .env is the source of truth for the container's secrets (PocketBase
+# superuser, Shopify credentials, Sentry) and is read by systemd through the
+# unit's EnvironmentFile, not by Ansible.
+- name: Confirm the podman user's uid still matches the pinned one
+  ansible.builtin.assert:
+    that: ansible_user_uid | int == podman_uid | int
+    fail_msg: >-
+      {{ podman_user }} is uid {{ ansible_user_uid }} on this host, but
+      vars/default.yml pins podman_uid={{ podman_uid }} (used to build the
+      play-level XDG_RUNTIME_DIR). Update the pin.
+    quiet: true
 
-- name: Upload the .env file
-  template:
+- name: Ensure the mozimo data, unit and analytics directories exist
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0755"
+  loop:
+    - "{{ podman_data }}"
+    - "{{ host_directory }}"
+    - "{{ host_directory }}/pb_data"
+    - "{{ vince_directory }}"
+    - "{{ quadlet_dir }}"
+    - "{{ caddy_dropin_dir }}"
+
+- name: Upload the runtime environment file
+  ansible.builtin.template:
     src: "files/.env"
     dest: "{{ host_directory }}/.env"
+    mode: "0600"
+  notify: Restart Mozimo