Drive maptool's deploy through the podman-compose@ systemd service

The service's own ExecStart deliberately runs a plain podman compose
up (no --build) since ExecStartPre already tears down the previous
containers/networks/volumes on every start — but that leaves the
built image alone, so the deploy job now removes it directly first
(what forces a fresh build) and drives start/stop through systemctl
rather than calling podman/docker compose by hand. Also switches
/srv/docker/maptool to /srv/podman/maptool per the symlink now in
place, and updates deployment.adoc to match.

.gitea/workflows/ci.yml

@@ -35,7 +35,7 @@ jobs:
 
   # Handled by a separate, native (non-Docker) runner registered with the
   # single "cube-host" label (see docs/deployment.adoc) — it runs directly
-  # on the server, so it has docker/git/etc. from the host, no socket/bind
+  # on the server, so it has podman/git/etc. from the host, no socket/bind
   # mount tricks needed. The Docker-based runner keeps handling `check`.
   deploy:
     needs: check
@@ -68,15 +68,15 @@ jobs:
       # alone too — the glob below doesn't match them — and neither is ever
       # part of the git checkout in the first place, since both are
       # gitignored.
-      - name: Sync to /srv/docker/maptool
+      - name: Sync to /srv/podman/maptool
         run: |
-          mkdir -p /srv/docker/maptool
-          for f in /srv/docker/maptool/*; do
+          mkdir -p /srv/podman/maptool
+          for f in /srv/podman/maptool/*; do
             [ "$(basename "$f")" = "data" ] && continue
             rm -rf "$f"
           done
-          cp -a . /srv/docker/maptool/
-          rm -rf /srv/docker/maptool/.git
+          cp -a . /srv/podman/maptool/
+          rm -rf /srv/podman/maptool/.git
 
       # Regenerated on every deploy from repo secrets (Settings -> Actions
       # -> Secrets) rather than created once by hand on the server — see
@@ -88,16 +88,27 @@ jobs:
       # actually reads.
       - name: Write .env
         run: |
-          cat > /srv/docker/maptool/.env <<EOF
+          cat > /srv/podman/maptool/.env <<EOF
           SESSION_SECRET=${{ secrets.SESSION_SECRET }}
           GITEA_OAUTH_CLIENT_ID=${{ secrets.OAUTH_CLIENT_ID }}
           GITEA_OAUTH_CLIENT_SECRET=${{ secrets.OAUTH_CLIENT_SECRET }}
           MAPTOOL_ALLOWED_GITEA_USER=${{ secrets.MAPTOOL_ALLOWED_GITEA_USER }}
           LIVETRACK_WEBHOOK_SECRET=${{ secrets.LIVETRACK_WEBHOOK_SECRET }}
           EOF
-          chmod 600 /srv/docker/maptool/.env
+          chmod 600 /srv/podman/maptool/.env
 
+      # podman-compose@maptool.service (/etc/systemd/system/podman-compose@.service)
+      # owns the container lifecycle — its ExecStartPre already tears down
+      # the previous containers/networks/volumes on every start, but not
+      # the built image, and its ExecStart runs a plain `podman compose up`
+      # (deliberately no `--build`), which only builds when the image tag
+      # isn't already present locally. So a bare restart would just
+      # relaunch the previous image; removing that tag first forces a
+      # fresh build from the code just synced above. sudo is needed since
+      # the unit — and thus the image — is root's, not gitea-runner's own
+      # (gitea-runner has passwordless sudo for this on cube-host).
       - name: Deploy
         run: |
-          cd /srv/docker/maptool
-          docker compose -p maptool up --build -d
+          sudo systemctl stop podman-compose@maptool.service
+          sudo podman rmi -f docker.io/library/maptool:latest || true
+          sudo systemctl start podman-compose@maptool.service