anubis: run the image under a localhost/ alias tag

On this host's podman 5.7 quadlet path, a registry-prefixed Image ref
fails to resolve from local storage at container create time even when
the image is present ('image not known'); the identical argv works from
a shell or transient unit. Verified live: an identical unit with
Image=localhost/techarohq/anubis:v1.13.0 starts immediately. The deploy
handler now tags the alias after the guarded pull; upgrades re-tag
after pulling the new tag.

dankclaw/anubis/quadlet/anubis.container

@@ -11,11 +11,16 @@
 # per-vhost routing — including Authentik forward_auth — resumes. Host headers
 # survive both hops, so vhost matching on the internal listener still works.
 #
-# Version pin: ghcr.io/techaroq/anubis:v1.13.0 was source-verified before
+# Image pin: the image is pulled from ghcr.io/techarohq/anubis (source of
-# pinning (policy parser is JSON-only at this tag, flags are the config
+# truth), but the unit runs it under a localhost/-aliased tag: on this host's
-# surface via flagenv: an env var named TARGET sets --target, POLICY_FNAME
+# podman 5.7 quadlet path, registry-prefixed refs fail to resolve from local
-# sets --policy-fname). Upgrading = stop unit, change Image=, deploy; policy
+# storage at container create time ("image not known") even when present; the
-# schema must be re-verified against the new tag first.
+# localhost alias resolves (verified live 2026-08-28). v1.13.0 was
+# source-verified before pinning (policy parser is JSON-only at this tag,
+# flags are the config surface via flagenv: TARGET sets --target,
+# POLICY_FNAME sets --policy-fname). Upgrading = pull new tag, re-tag the
+# localhost alias, restart the unit; re-verify the policy schema first.
+# (the active Image= key lives in the [Container] section below)
 #
 # No secrets here: Anubis holds no credentials (memory store; challenge
 # cookies are client-side JWTs). A restart invalidates issued challenges —
@@ -28,7 +33,7 @@ Wants=network-online.target
 
 [Container]
 ContainerName=anubis
-Image=ghcr.io/techaroq/anubis:v1.13.0
+Image=localhost/techarohq/anubis:v1.13.0
 Pull=never
 Network=dankclaw_default
 # flagenv maps env names to flag names (TARGET -> --target, POLICY_FNAME ->

scripts/deploy-remote.sh

@@ -557,6 +557,10 @@ deploy_anubis() {
     if ! podman image exists ghcr.io/techarohq/anubis:v1.13.0; then
         podman pull ghcr.io/techaroq/anubis:v1.13.0
     fi
+    # The unit runs the localhost/ alias (see the unit file comment): this
+    # host's podman quadlet path cannot resolve registry-prefixed refs from
+    # local storage at create time. Tag first, then (re)create via deploy.
+    podman tag ghcr.io/techarohq/anubis:v1.13.0 localhost/techarohq/anubis:v1.13.0 2>/dev/null || true
     cp "dankclaw/anubis/quadlet/anubis.container" "$quadlet_unit_dir/"
     systemctl --user daemon-reload
     # No enable: generated units cannot be enabled on this host (v1 quadlet