Add the menu-admin playbook

Deploys the menu app for one Site: pulls the tag, creates the data root, runs
the container against a config baked into the image, waits for health, verifies
the data directory, and points Caddy at the app with a marker it can update in
place. The parallel run uses a temporary hostname; cutover sets the retire
flags.

menu-admin/vars/default.yml

@@ -0,0 +1,29 @@
+---
+# Defaults shared by every Site. Override per Site in vars/<site>.yml, and pass
+# -e site=<site> on the command line.
+
+# Which Site config inside the image to run, and therefore which vhost it is
+# for. The file lives in the app repo at config/<site>.site.json.
+site: hopsngrains
+
+image_name: registry.tanshu.com/menu-admin
+image_tag: "{{ tag | default('latest') }}"
+
+# The hostname Caddy serves this Site on. The parallel run uses a temporary
+# name; cutover points the real one at the app.
+vhost: "{{ host }}"
+
+# Cutover switches. Both stay off until the parallel run has been checked.
+retire_nginx_snippet: false
+retire_nginx_container: false
+
+app_uid: 1000
+app_gid: 1000
+
+caddy_container: caddy
+caddyfile_path: /var/lib/caddy/conf/Caddyfile
+
+caddy_snippet: |
+  {{ vhost }} {
+      reverse_proxy {{ docker_container }}:3000
+  }