Fix prod compose port collision and make ansible deploy re-runnable

docker-compose.prod.yml: compose merges `ports` by appending, so the prod
override left the base file's 8888:8000 and 3000:3000 in place next to the
127.0.0.1-scoped ones. Each container tried to bind its port twice and the
second bind failed with "address already in use", so c2-core and frontend
could never start. It also meant the localhost-only binding never applied —
both ports were published on every interface. Marked both `!override`, the
same way mosquitto already used `!reset`.

infra/ansible:
- add the missing "Reload Caddy" handler; the Deploy Caddyfile task notified
  a handler that did not exist, which aborts the play
- guard mkswap/swapon on whether /swapfile is already active, so a second run
  does not fail on "mounted" / "Device or resource busy"
- git task now updates instead of clone-once, otherwise a re-run redeploys
  whatever code was on the VM at first clone
- vault.yml.example: correct the registry token comment to read-only scope

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

infra/ansible/roles/deploy/handlers/main.yml

@@ -0,0 +1,13 @@
+---
+# The "Deploy Caddyfile" task notifies this. Without this file the play aborts
+# with "The requested handler 'Reload Caddy' was not found" — notify does not
+# tolerate a missing handler.
+#
+# reloaded, not restarted: caddy reload swaps config with zero downtime and
+# keeps existing TLS certs/connections; a restart drops every in-flight request.
+
+- name: Reload Caddy
+  ansible.builtin.systemd_service:
+    name: caddy
+    state: reloaded
+    enabled: true