Fix prod compose port collision and make ansible deploy re-runnable

docker-compose.prod.yml: compose merges `ports` by appending, so the prod
override left the base file's 8888:8000 and 3000:3000 in place next to the
127.0.0.1-scoped ones. Each container tried to bind its port twice and the
second bind failed with "address already in use", so c2-core and frontend
could never start. It also meant the localhost-only binding never applied —
both ports were published on every interface. Marked both `!override`, the
same way mosquitto already used `!reset`.

infra/ansible:
- add the missing "Reload Caddy" handler; the Deploy Caddyfile task notified
  a handler that did not exist, which aborts the play
- guard mkswap/swapon on whether /swapfile is already active, so a second run
  does not fail on "mounted" / "Device or resource busy"
- git task now updates instead of clone-once, otherwise a re-run redeploys
  whatever code was on the VM at first clone
- vault.yml.example: correct the registry token comment to read-only scope

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.prod.yml

@@ -12,9 +12,14 @@ services:
     restart: always
     ports: !reset []   # Remove the dev 1883:1883 mapping — internal only
 
+  # !override, not a plain list: compose MERGES `ports` by appending, so a plain
+  # list leaves the base file's "8888:8000" in place alongside this one. The
+  # container then tries to bind 8888 twice — 0.0.0.0 and 127.0.0.1 — and the
+  # second bind fails with "address already in use". It also silently defeated
+  # the whole point of this override, publishing the port on every interface.
   c2-core:
     restart: always
-    ports:
+    ports: !override
       - "127.0.0.1:8888:8000"  # Caddy proxies, not exposed publicly
 
   discord-bot:
@@ -22,5 +27,5 @@ services:
 
   frontend:
     restart: always
-    ports:
+    ports: !override
       - "127.0.0.1:3000:3000"  # Caddy proxies, not exposed publicly