ci(deploy): fix lftp auth — explicit empty password + unindented script

Two issues from the previous lftp run:
- "GetPass() failed -- assume anonymous login" / "Password required":
  without `-u USER,` (trailing comma = empty password), lftp tries
  to prompt for a password instead of relying on the ssh key passed
  via sftp:connect-program.
- Heredoc body was indented with leading whitespace; lftp can mis-
  parse leading-whitespace lines as command continuations.

Also bump verbosity (`debug 3`) so the ssh command lftp launches
is logged — makes the next failure easier to read — and bound
retries to 1 so we fail fast in CI.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -118,12 +118,20 @@ jobs:
           : "${SFTP_USER:?SFTP_USER secret must be set}"
           : "${SFTP_HOST:?SFTP_HOST secret must be set}"
           : "${SFTP_PATH:?SFTP_PATH secret must be set}"
+          # `-u USER,` (with trailing comma = empty password) tells lftp not
+          # to prompt for a password; auth happens via the key passed to ssh
+          # by sftp:connect-program. Heredoc body is unindented so lftp's
+          # parser doesn't mistake leading whitespace for a continuation.
+          # `debug 3` prints the ssh command lftp invokes — useful if this
+          # ever breaks again.
           lftp <<LFTP
-            set cmd:fail-exit yes
+          debug 3
-            set sftp:connect-program 'ssh -a -x -i $HOME/.ssh/id_ed25519 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts'
+          set cmd:fail-exit yes
-            open sftp://$SFTP_USER@$SFTP_HOST
+          set net:max-retries 1
-            mirror --reverse --delete --verbose --parallel=4 dist/ $SFTP_PATH/
+          set sftp:connect-program 'ssh -a -x -i $HOME/.ssh/id_ed25519 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts'
-            bye
+          open -u $SFTP_USER, sftp://$SFTP_HOST
+          mirror --reverse --delete --verbose --parallel=4 dist/ $SFTP_PATH/
+          bye
           LFTP
 
       - name: Post-deploy smoke test