Fix prod compose port collision and make ansible deploy re-runnable

docker-compose.prod.yml: compose merges `ports` by appending, so the prod
override left the base file's 8888:8000 and 3000:3000 in place next to the
127.0.0.1-scoped ones. Each container tried to bind its port twice and the
second bind failed with "address already in use", so c2-core and frontend
could never start. It also meant the localhost-only binding never applied —
both ports were published on every interface. Marked both `!override`, the
same way mosquitto already used `!reset`.

infra/ansible:
- add the missing "Reload Caddy" handler; the Deploy Caddyfile task notified
  a handler that did not exist, which aborts the play
- guard mkswap/swapon on whether /swapfile is already active, so a second run
  does not fail on "mounted" / "Device or resource busy"
- git task now updates instead of clone-once, otherwise a re-run redeploys
  whatever code was on the VM at first clone
- vault.yml.example: correct the registry token comment to read-only scope

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

infra/ansible/roles/deploy/handlers/main.yml

@@ -0,0 +1,13 @@
+---
+# The "Deploy Caddyfile" task notifies this. Without this file the play aborts
+# with "The requested handler 'Reload Caddy' was not found" — notify does not
+# tolerate a missing handler.
+#
+# reloaded, not restarted: caddy reload swaps config with zero downtime and
+# keeps existing TLS certs/connections; a restart drops every in-flight request.
+
+- name: Reload Caddy
+  ansible.builtin.systemd_service:
+    name: caddy
+    state: reloaded
+    enabled: true

infra/ansible/roles/deploy/tasks/main.yml

@@ -2,12 +2,19 @@
 # First-time setup: clone repo, write secrets, pull pre-built images and start stack.
 # Images are built and pushed by Gitea CI — this role never builds on the VM.
 
-- name: Clone repo (skipped if already present)
+# update: true (was false) — with update disabled, every re-run of this playbook
+# redeployed the code that happened to be on the VM at first clone, so any fix
+# pushed to main was invisible here and the only way to ship one was CI or a
+# manual pull. force: true discards local edits made on the VM; the templated
+# .env files and Caddyfile live outside git tracking, so nothing generated by
+# this role is at risk.
+- name: Clone or update repo
   git:
     repo: "{{ repo_url }}"
     dest: "{{ app_dir }}"
     version: main
-    update: false
+    update: true
+    force: true
   become: false
 
 - name: Set ownership of app directory