Add the menu-admin playbook

Deploys the menu app for one Site: pulls the tag, creates the data root, runs
the container against a config baked into the image, waits for health, verifies
the data directory, and points Caddy at the app with a marker it can update in
place. The parallel run uses a temporary hostname; cutover sets the retire
flags.

menu-admin/vars/hopsngrains.yml

@@ -0,0 +1,20 @@
+---
+# Hops n Grains. The Section list and branding live in the app repo at
+# config/hopsngrains.site.json, which is baked into the image, so this file
+# only says where to run it.
+site: hopsngrains
+
+host: menu.hopsngrains.com
+
+docker_container: menu-app.hopsngrains.com
+docker_network: "{{ docker_container }}_net"
+
+# First deployment: a temporary hostname beside the existing site.
+vhost: menu-new.hopsngrains.com
+
+# Everything the app writes — data/ and the untracked site.env.
+app_root: /var/lib/menu-app.hopsngrains.com
+
+# The old nginx container serving /var/lib/menu.hopsngrains.com. Left alone
+# until cutover.
+legacy_container: nginx-menu.hopsngrains.com