Add the menu-admin playbook

Deploys the menu app for one Site: pulls the tag, creates the data root, runs
the container against a config baked into the image, waits for health, verifies
the data directory, and points Caddy at the app with a marker it can update in
place. The parallel run uses a temporary hostname; cutover sets the retire
flags.

menu-admin/roles/caddy/tasks/main.yaml

@@ -0,0 +1,39 @@
+---
+- name: Check the Caddyfile exists
+  stat:
+    path: "{{ caddyfile_path }}"
+  register: menu_caddyfile
+
+- name: Fail when Caddy is not where we expect it
+  fail:
+    msg: >-
+      {{ caddyfile_path }} is missing. Deploy the caddy playbook (which owns the
+      Caddy container and its config) before this one.
+  when: not menu_caddyfile.stat.exists
+
+# blockinfile replaces whatever sits between its markers, so changing `vhost`
+# updates the snippet in place. The sibling nginx-menu role only appended a
+# block when its exact text was absent, which cannot change a proxy target.
+- name: Point Caddy at the app
+  blockinfile:
+    path: "{{ caddyfile_path }}"
+    marker: "# {mark} ANSIBLE MANAGED: menu app ({{ site }})"
+    block: "{{ caddy_snippet }}"
+    create: no
+  notify: Reload Caddy
+
+- name: Remove the snippet the nginx-menu playbook wrote for this vhost
+  # A different marker, written by a different role. Leaving it in place would
+  # leave Caddy with two blocks for the same hostname.
+  blockinfile:
+    path: "{{ caddyfile_path }}"
+    marker: "# {mark} Ansible managed Caddy snippet for {{ host }}"
+    state: absent
+  when: retire_nginx_snippet | bool
+  notify: Reload Caddy
+
+- name: Stop the old nginx container
+  docker_container:
+    name: "{{ legacy_container }}"
+    state: stopped
+  when: retire_nginx_container | bool