Add the menu-admin playbook

Deploys the menu app for one Site: pulls the tag, creates the data root, runs
the container against a config baked into the image, waits for health, verifies
the data directory, and points Caddy at the app with a marker it can update in
place. The parallel run uses a temporary hostname; cutover sets the retire
flags.

menu-admin/vars/default.yml

@@ -0,0 +1,29 @@
+---
+# Defaults shared by every Site. Override per Site in vars/<site>.yml, and pass
+# -e site=<site> on the command line.
+
+# Which Site config inside the image to run, and therefore which vhost it is
+# for. The file lives in the app repo at config/<site>.site.json.
+site: hopsngrains
+
+image_name: registry.tanshu.com/menu-admin
+image_tag: "{{ tag | default('latest') }}"
+
+# The hostname Caddy serves this Site on. The parallel run uses a temporary
+# name; cutover points the real one at the app.
+vhost: "{{ host }}"
+
+# Cutover switches. Both stay off until the parallel run has been checked.
+retire_nginx_snippet: false
+retire_nginx_container: false
+
+app_uid: 1000
+app_gid: 1000
+
+caddy_container: caddy
+caddyfile_path: /var/lib/caddy/conf/Caddyfile
+
+caddy_snippet: |
+  {{ vhost }} {
+      reverse_proxy {{ docker_container }}:3000
+  }

menu-admin/vars/hopsngrains.yml

@@ -0,0 +1,20 @@
+---
+# Hops n Grains. The Section list and branding live in the app repo at
+# config/hopsngrains.site.json, which is baked into the image, so this file
+# only says where to run it.
+site: hopsngrains
+
+host: menu.hopsngrains.com
+
+docker_container: menu-app.hopsngrains.com
+docker_network: "{{ docker_container }}_net"
+
+# First deployment: a temporary hostname beside the existing site.
+vhost: menu-new.hopsngrains.com
+
+# Everything the app writes — data/ and the untracked site.env.
+app_root: /var/lib/menu-app.hopsngrains.com
+
+# The old nginx container serving /var/lib/menu.hopsngrains.com. Left alone
+# until cutover.
+legacy_container: nginx-menu.hopsngrains.com