Deploy with rootless podman + Quadlet on emily

Retargets the build and the playbook off rootful Docker on monoco, following the
conventions already in place on emily's other services: Quadlet units in
~/.config/containers/systemd, per-service data in ~/podman-data, and a shared
Caddy that every service registers itself with — a network drop-in plus a
marked block in its Caddyfile. Nothing is published on the host; Caddy reaches
the containers by name over mozimo_net.

- Makefile: podman build + push instead of docker buildx, PLATFORMS=linux/arm64
  (both hosts are aarch64). podman has no built-in QEMU the way buildx's builder
  image does, so a foreign-platform failure now points at qemu-user-static.
- deploy.sh: pass COMMIT= to make, which the Makefile actually reads; it was
  passing TAG=, so the tag silently came from `git rev-parse` instead.
- ansible: hosts emily, become false, XDG_RUNTIME_DIR for rootless podman and
  systemctl --user. Docker modules become Quadlet templates with user-service
  handlers, and the network role now ships mozimo.network plus the Caddy drop-in
  rather than calling docker_network.
- UserNS=keep-id maps the container's uid 1000 (node) and root (vince) onto the
  host user, so PocketBase and Vince write host-owned files instead of
  subuid-owned ones; the play asserts the pinned uid still matches the host.
- ansible/README.md: the unit layout, the service-registration convention, and
  the monoco -> emily migration (PocketBase 23 MB + Vince 119 MB, DNS cutover,
  rollback).

Verified by a check-mode rehearsal against emily (13 ok / 8 changed / 0 failed)
and a disposable Quadlet unit on that host proving the uid mapping, the
EnvironmentFile and the isolated network. The real build and cutover have not
been run.

deploy.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
-# Mozimo deploy — build the exact commit at origin/main, tag it with its
-# commit id, and hand that tag to ansible. Guards make it impossible to
+# Mozimo deploy — build the exact commit at origin/main with podman, tag it
+# with its commit id, and hand that tag to ansible (which installs the Quadlet
+# unit on emily and restarts the user service). Guards make it impossible to
 # deploy anything other than what git knows about.
 #
 #   ./deploy.sh           deploy HEAD (must be pushed, tree must be clean)
@@ -41,7 +42,7 @@ fi
 git pull --ff-only
 TAG=$(git rev-parse --short HEAD)
 echo "▶ deploying commit $TAG"
-make build-production TAG="$TAG"
+make build-production COMMIT="$TAG"
 
 PRUNE_FLAG=""
 if [ "$PRUNE" = true ]; then