Add stop.sh (compose down) and disable print_forge.

Closes #33. Deploy skips host_apps.enabled: false so CI cannot resurrect a stopped app.

roles/app-deploy/tasks/main.yml

@@ -6,24 +6,21 @@
 # at branch master.
 #
 # host_apps (host_vars) lists what runs on THIS host; app_catalog (group_vars)
-# describes how each app is built.
+# describes how each app is built. host_apps.enabled: false (omit = true)
+# keeps the row for ports/stop.sh but skips deploy so CI cannot resurrect it.
 
 - name: Classify catalog by type
   ansible.builtin.set_fact:
     django_names: "{{ app_catalog | dict2items | selectattr('value.type', 'equalto', 'django') | map(attribute='key') | list }}"
     node_names: "{{ app_catalog | dict2items | selectattr('value.type', 'equalto', 'node-static') | map(attribute='key') | list }}"
 
-- name: Resolve deploy targets for {{ inventory_hostname }}
+- name: Resolve matching host_apps for {{ inventory_hostname }}
   ansible.builtin.set_fact:
-    deploy_targets: >-
+    matching_host_apps: >-
       {{ (host_apps | default([]) | selectattr('name', 'equalto', app | default('')) | selectattr('env', 'equalto', app_env | default('')) | list)
          if (app is defined and app_env is defined)
          else (host_apps | default([])) }}
 
-- name: Show deploy targets
-  ansible.builtin.debug:
-    msg: "ref={{ app_ref | default('(per-app default branch)') }} targets={{ deploy_targets | map(attribute='name') | zip(deploy_targets | map(attribute='env')) | list }}"
-
 # Explicit --app/--env with no host_apps match used to silently no-op Django
 # and still refresh web-static (looked like a "static-only" deploy). Fail loud.
 - name: Fail when requested app+env is not on this host
@@ -36,7 +33,22 @@
   when:
     - app is defined
     - app_env is defined
-    - deploy_targets | length == 0
+    - matching_host_apps | length == 0
+
+- name: "Drop disabled host_apps (enabled: false)"
+  ansible.builtin.set_fact:
+    deploy_targets: "{{ matching_host_apps | rejectattr('enabled', 'equalto', false) | list }}"
+
+- name: Show skipped disabled apps
+  ansible.builtin.debug:
+    msg: "skip disabled {{ item.name }}/{{ item.env }} on {{ inventory_hostname }}"
+  loop: "{{ matching_host_apps | selectattr('enabled', 'equalto', false) | list }}"
+  loop_control:
+    label: "{{ item.name }}/{{ item.env }}"
+
+- name: Show deploy targets
+  ansible.builtin.debug:
+    msg: "ref={{ app_ref | default('(per-app default branch)') }} targets={{ deploy_targets | map(attribute='name') | zip(deploy_targets | map(attribute='env')) | list }}"
 
 - name: Fail when requested app missing from app_catalog
   ansible.builtin.fail: