Register dta_blog for node-static deploy (closes #29) (#30)

## Summary
- Closes [#29](#29).
- Register `dta_blog` in `app_catalog` (`type: node-static`, repo `Ditch_The_Agent/dta_blog`, default branch `main`, webroot `/var/www/{env}.blog.realpath.app/html`). Reuses `roles/app-deploy/tasks/node_static.yml` (`npm ci` then `npm run build:<env>`); the blog's `package.json` copies `dist/` to that webroot after `python3 build.py --env <env>`.
- Add prod **8086** / beta **8087** `host_apps` on adama, roslin, starbuck, apollo, and ai-server-4080 (those ports were free vs 8080–8085 / 8088).
- Optional nginx `error_page 404 /404.html` for this app only (`error_page_404` catalog field); other static apps keep the SPA `try_files` fallback.
- Document NPM/DNS (`blog.realpath.app` → `:8086`, `beta.blog.realpath.app` → `:8087`), no `realpath.app/blog` mount, and UFW staying LAN/NPM-only.

## Test plan
- [ ] Confirm 8086/8087 unused on app hosts before first deploy.
- [ ] `./scripts/deploy.sh --app dta_blog --env beta --ref main` publishes `/var/www/beta.blog.realpath.app/html`.
- [ ] `./scripts/deploy.sh --app dta_blog --env prod --ref main` publishes `/var/www/prod.blog.realpath.app/html`.
- [ ] **Until [dta_blog#1](Ditch_The_Agent/dta_blog#1) is on `main`**, use `--ref issue-1-static-blog` so the SSG (not the stub README) is built.
- [ ] NPM + DNS + TLS: `blog.realpath.app` → `:8086`, `beta.blog.realpath.app` → `:8087`. Do not reverse-proxy onto `realpath.app/blog`.
- [ ] Prod HTML has article text, Tianji id `cmtvvmf562afjzqumwt1yh2y8`, links to `https://realpath.app/`.
- [ ] Beta HTML has Tianji id `cmtvvn6z62agdzqumtk8xijpy`, links to `https://beta.realpath.app/`, demo posts present.
- [ ] `https://blog.realpath.app/sitemap.xml`, `robots.txt`, `llms.txt` return 200.
- [ ] Unknown slug returns 404.html (not the index SPA fallback).

Reviewed-on: #30

inventory/host_vars/ai-server-4080.yml

@@ -27,6 +27,8 @@ host_apps:
   - { name: company_site, env: prod, port: 8000 }
   - { name: dta_webapp, env: prod, port: 8080 }
   - { name: dta_webapp, env: beta, port: 8081 }
+  - { name: dta_blog, env: prod, port: 8086 }
+  - { name: dta_blog, env: beta, port: 8087 }
   - { name: dta_service, env: prod, port: 8001 }
   - { name: dta_service, env: beta, port: 8011 }
   - { name: scha, env: prod, port: 8002 }