Add stop.sh (compose down) and disable print_forge (#34)

## Summary
- Closes [#33](#33).
- Add `scripts/stop.sh` → `playbooks/stop-apps.yml` → `docker compose down` for one `--app` + `--env` (no `-v`; checkouts/secrets stay).
- `host_apps.enabled: false` skips deploy (including CI `--app`) so a stopped app cannot come back. Rows stay for ports and `stop.sh`.
- Disable `print_forge` beta + prod on all app hosts. After merge (or from this branch): `./scripts/stop.sh --app print_forge --env prod` and `--env beta`.

## Test plan
- [ ] `./scripts/stop.sh --help` shows required `--app` / `--env`
- [ ] `ansible-playbook playbooks/stop-apps.yml --syntax-check -e app=print_forge -e app_env=prod`
- [ ] `./scripts/stop.sh --app print_forge --env prod` compose-downs `print_forge_prod` on all webservers
- [ ] `./scripts/stop.sh --app print_forge --env beta` compose-downs `print_forge_beta` (including adama worker)
- [ ] `./scripts/deploy.sh --app print_forge --env prod --check` skips disabled rows (does not start containers)
- [ ] NPM: `print-forge-preview.aimloperations.com` will 502 until the proxy host is disabled (out of scope)

Reviewed-on: #34

roles/app-deploy/tasks/stop_django.yml

@@ -0,0 +1,72 @@
+---
+# Compose-down one Django app+env. Called per item with loop_var app_item.
+# No `down -v` — volumes stay. Checkout and secrets stay.
+
+- name: "stop[{{ app_item.name }}/{{ app_item.env }}] locals"
+  ansible.builtin.set_fact:
+    _spec: "{{ app_catalog[app_item.name] }}"
+    _src: "{{ apps_src_dir }}/{{ app_item.name }}_{{ app_item.env }}"
+    _project: "{{ app_item.name }}_{{ app_item.env }}"
+
+- name: "stop[{{ _project }}] checkout dir"
+  ansible.builtin.stat:
+    path: "{{ _src }}"
+  register: _src_stat
+
+- name: "stop[{{ _project }}] compose file"
+  ansible.builtin.stat:
+    path: "{{ _src }}/{{ _spec.compose_file }}"
+  register: _compose_stat
+  when: _src_stat.stat.exists
+
+- name: "stop[{{ _project }}] env file"
+  ansible.builtin.stat:
+    path: "{{ _src }}/.env"
+  register: _env_stat
+  when: _src_stat.stat.exists
+
+- name: "stop[{{ _project }}] use compose down"
+  ansible.builtin.set_fact:
+    _use_compose: "{{ _src_stat.stat.exists and _compose_stat is defined and _compose_stat.stat.exists }}"
+
+- name: "stop[{{ _project }}] compose down"
+  ansible.builtin.command:
+    cmd: >-
+      docker compose -f {{ _spec.compose_file }}
+      {{ '--env-file .env' if (_env_stat is defined and _env_stat.stat.exists) else '' }}
+      down
+    chdir: "{{ _src }}"
+  environment:
+    COMPOSE_PROJECT_NAME: "{{ _project }}"
+    WEB_PORT: "{{ app_item.port }}"
+    COMPOSE_PROFILES: "{{ (app_item.compose_profiles | default([])) | join(',') }}"
+  become: true
+  become_user: "{{ admin_user }}"
+  when: _use_compose | bool
+  changed_when: true
+
+- name: "stop[{{ _project }}] find leftover project containers"
+  ansible.builtin.command:
+    cmd: docker ps -aq --filter label=com.docker.compose.project={{ _project }}
+  register: _leftovers
+  changed_when: false
+  become: true
+  when: not (_use_compose | bool)
+
+- name: "stop[{{ _project }}] remove leftover project containers"
+  ansible.builtin.command:
+    cmd: "docker rm -f {{ _leftovers.stdout_lines | join(' ') }}"
+  become: true
+  when:
+    - not (_use_compose | bool)
+    - _leftovers is defined
+    - _leftovers.stdout_lines | length > 0
+  changed_when: true
+
+- name: "stop[{{ _project }}] nothing to stop (no checkout)"
+  ansible.builtin.debug:
+    msg: "no checkout at {{ _src }} and no containers for project {{ _project }}"
+  when:
+    - not (_use_compose | bool)
+    - _leftovers is defined
+    - _leftovers.stdout_lines | length == 0