Fix prod compose port collision and make ansible deploy re-runnable

docker-compose.prod.yml: compose merges `ports` by appending, so the prod
override left the base file's 8888:8000 and 3000:3000 in place next to the
127.0.0.1-scoped ones. Each container tried to bind its port twice and the
second bind failed with "address already in use", so c2-core and frontend
could never start. It also meant the localhost-only binding never applied —
both ports were published on every interface. Marked both `!override`, the
same way mosquitto already used `!reset`.

infra/ansible:
- add the missing "Reload Caddy" handler; the Deploy Caddyfile task notified
  a handler that did not exist, which aborts the play
- guard mkswap/swapon on whether /swapfile is already active, so a second run
  does not fail on "mounted" / "Device or resource busy"
- git task now updates instead of clone-once, otherwise a re-run redeploys
  whatever code was on the VM at first clone
- vault.yml.example: correct the registry token comment to read-only scope

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

infra/ansible/site.yml

@@ -36,16 +36,33 @@
         path: /swapfile
         mode: "0600"
 
+    # mkswap refuses to touch a file that is already active as swap, so a
+    # re-run would fail here without this guard. The swap file survives
+    # reboots via the fstab entry below, so on any second run it IS active.
+    - name: Check whether the swap file is already active
+      command: swapon --show=NAME --noheadings
+      register: _active_swaps
+      changed_when: false
+      failed_when: false
+
     - name: Format swap file
       command: mkswap /swapfile
+      when: "'/swapfile' not in _active_swaps.stdout"
       register: _mkswap
       changed_when: _mkswap.rc == 0
 
+    # Guarded by the same check as mkswap above. The stderr test alone was not
+    # enough: an already-active swap file reports "Device or resource busy",
+    # not "already", so the original failed_when never matched it.
     - name: Enable swap
       command: swapon /swapfile
+      when: "'/swapfile' not in _active_swaps.stdout"
       register: _swapon
-      failed_when: _swapon.rc != 0 and 'already' not in _swapon.stderr
-      changed_when: _swapon.rc == 0
+      failed_when: >
+        _swapon.rc is defined and _swapon.rc != 0
+        and 'already' not in _swapon.stderr
+        and 'busy' not in _swapon.stderr
+      changed_when: _swapon.rc is defined and _swapon.rc == 0
 
     - name: Persist swap in fstab
       lineinfile: