Add the menu-admin playbook

Deploys the menu app for one Site: pulls the tag, creates the data root, runs
the container against a config baked into the image, waits for health, verifies
the data directory, and points Caddy at the app with a marker it can update in
place. The parallel run uses a temporary hostname; cutover sets the retire
flags.

menu-admin/roles/menu-app/tasks/main.yaml

@@ -0,0 +1,91 @@
+---
+- name: Pull the app image
+  docker_image:
+    name: "{{ image_name }}"
+    tag: "{{ image_tag }}"
+    source: pull
+    force_source: yes
+
+- name: Ensure the app root exists
+  file:
+    path: "{{ app_root }}"
+    state: directory
+    owner: "{{ app_uid }}"
+    group: "{{ app_gid }}"
+    mode: "0750"
+
+- name: Ensure the data directory exists
+  file:
+    path: "{{ app_root }}/data"
+    state: directory
+    owner: "{{ app_uid }}"
+    group: "{{ app_gid }}"
+    mode: "0750"
+
+- name: Look for the untracked site.env
+  stat:
+    path: "{{ app_root }}/site.env"
+  register: menu_site_env
+
+- name: Warn when the admin has no password yet
+  debug:
+    msg: >-
+      {{ app_root }}/site.env is missing, so the admin is disabled: the public
+      menu still serves. Run scripts/provision-site-env.sh {{ app_root }} on
+      this host, then re-run this playbook.
+  when: not menu_site_env.stat.exists
+
+- name: Run the menu app
+  docker_container:
+    name: "{{ docker_container }}"
+    image: "{{ image_name }}:{{ image_tag }}"
+    state: started
+    restart_policy: unless-stopped
+    user: "{{ app_uid }}:{{ app_gid }}"
+    env:
+      MENU_ROOT: /data
+      MENU_SITE_CONFIG: "/app/config/{{ site }}.site.json"
+      SECURE_COOKIES: "true"
+      LOG_LEVEL: info
+      PORT: "3000"
+    volumes:
+      - "{{ app_root }}:/data"
+    networks:
+      - name: "{{ docker_network }}"
+
+- name: Wait for the app to answer
+  uri:
+    url: "http://{{ docker_container }}:3000/healthz"
+    status_code: 200
+  register: menu_health
+  retries: 10
+  delay: 2
+  until: menu_health.status == 200
+  changed_when: false
+
+- name: Check the data directory for integrity problems
+  # Reads the same directory the container writes, as the same user, so a
+  # permissions mistake shows up here rather than at 8pm service.
+  command:
+    argv:
+      - docker
+      - run
+      - --rm
+      - --user
+      - "{{ app_uid }}:{{ app_gid }}"
+      - -e
+      - MENU_ROOT=/data
+      - -e
+      - "MENU_SITE_CONFIG=/app/config/{{ site }}.site.json"
+      - --entrypoint
+      - node
+      - "{{ image_name }}:{{ image_tag }}"
+      - src/cli/verify.ts
+  register: menu_verify
+  changed_when: false
+  failed_when: false
+
+- name: Report integrity problems
+  debug:
+    msg: "{{ menu_verify.stdout_lines | default([]) }}"
+  when: menu_verify.rc != 0