ci(deploy): merge build+deploy into one job, manual trigger only

Two changes:

1. Merge build and deploy jobs into a single 'deploy' job. This
   eliminates the actions/upload-artifact@v3 round-trip, which was
   silently stripping dotfiles (.htaccess) from the artifact and
   leaving the deployed origin without security headers. The built
   dist/ (including .htaccess) now flows directly into rsync in the
   same workspace.

2. Remove the 'push: branches: [main]' trigger so deploy runs only
   on workflow_dispatch (manual click in Gitea Actions UI).
   Merges to main no longer auto-deploy — production promotion is
   an explicit user action.

The concurrency group at workflow level still prevents overlapping
deploys. All secrets remain unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -1,10 +1,14 @@
 # -----------------------------------------------------------------------------
 # cameleer-website — Deploy to Hetzner Webhosting L
 #
-# Runs ONLY on pushes to `main` and on manual dispatch from the Gitea UI.
-# Does NOT run Lighthouse CI (that's in ci.yml — assume any commit that reached
-# main already passed the full gate). Rebuilds fresh, runs the TBD guard, and
-# rsyncs `dist/` to the origin over SSH with host-key pinning.
+# MANUAL TRIGGER ONLY. Runs exclusively on workflow_dispatch from the Gitea UI
+# (Actions → deploy → Run workflow). Does NOT auto-deploy on push to main —
+# merges to main must be explicitly promoted to production.
+#
+# Build and deploy run in a single job so the built dist/ (including
+# dotfiles like .htaccess) flows directly into rsync. An earlier split-job
+# design was abandoned because actions/upload-artifact@v3 excludes dotfiles
+# by default and the v4 client does not work on Gitea Actions / GHES.
 #
 # Runner: self-hosted arm64 Gitea runner. Adjust `runs-on` if your runner's
 # labels differ. Deploy target is Hetzner amd64 — arch mismatch is a non-issue
@@ -12,15 +16,12 @@
 #
 # Required secrets (repo settings → Actions → Secrets):
 #   SFTP_HOST, SFTP_USER, SFTP_PATH, SFTP_KEY, SFTP_KNOWN_HOSTS
-# Required variables (repo settings → Actions → Variables):
 #   PUBLIC_AUTH_SIGNIN_URL, PUBLIC_AUTH_SIGNUP_URL, PUBLIC_SALES_EMAIL
 # -----------------------------------------------------------------------------
 
 name: deploy
 
 on:
-  push:
-    branches: [main]
   workflow_dispatch:
 
 concurrency:
@@ -28,9 +29,9 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  build:
+  deploy:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 25
     env:
       PUBLIC_AUTH_SIGNIN_URL: ${{ secrets.PUBLIC_AUTH_SIGNIN_URL }}
       PUBLIC_AUTH_SIGNUP_URL: ${{ secrets.PUBLIC_AUTH_SIGNUP_URL }}
@@ -53,6 +54,15 @@ jobs:
       - name: Build site
         run: npm run build
 
+      # Astro/Vite does not copy dotfiles from public/ into dist/, so .htaccess
+      # never reaches the deployed origin and Apache never sees the security
+      # headers it sets. Copy it explicitly. Fail if the source is missing
+      # rather than silently shipping a header-less site.
+      - name: Copy .htaccess into dist
+        run: |
+          test -f public/.htaccess
+          cp public/.htaccess dist/.htaccess
+
       - name: Guard — no TBD markers may ship in built HTML
         run: |
           if grep -rlE '(TBD):' dist 2>/dev/null | grep -E '\.(html|svg)$'; then
@@ -61,28 +71,6 @@ jobs:
             exit 1
           fi
 
-      # Pin to v3 — Gitea Actions implements the v3 artifact protocol.
-      # upload/download-artifact@v4 talk to a github.com-only backend and
-      # fail with GHESNotSupportedError on Gitea / Forgejo / GHES.
-      - name: Upload dist artifact
-        uses: actions/upload-artifact@v3
-        with:
-          name: dist
-          path: dist/
-          retention-days: 7
-
-  deploy:
-    needs: build
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    steps:
-      - name: Download dist artifact
-        uses: actions/download-artifact@v3
-        with:
-          name: dist
-          path: dist/
-
       - name: Configure SSH
         env:
           SFTP_KEY: ${{ secrets.SFTP_KEY }}
@@ -96,43 +84,33 @@ jobs:
           chmod 600 ~/.ssh/id_ed25519
           printf '%s\n' "$SFTP_KNOWN_HOSTS" > ~/.ssh/known_hosts
           chmod 644 ~/.ssh/known_hosts
-          # Hetzner Webhosting accounts are SFTP-only — they accept SSH for file
-          # transfer but refuse remote command exec ("exec request failed on
-          # channel 0"). rsync over SSH needs to spawn a remote rsync binary,
-          # so it cannot work here. Use lftp's mirror instead, which speaks
-          # SFTP end-to-end with the same key + known_hosts pinning.
-          if ! command -v lftp >/dev/null 2>&1 || ! command -v ssh >/dev/null 2>&1; then
+          # Ensure rsync + openssh are present even on a minimal runner image.
+          if ! command -v rsync >/dev/null 2>&1 || ! command -v ssh >/dev/null 2>&1; then
             if command -v sudo >/dev/null 2>&1; then SUDO=sudo; else SUDO=; fi
             $SUDO apt-get update -qq
-            $SUDO apt-get install -y --no-install-recommends lftp openssh-client
+            $SUDO apt-get install -y --no-install-recommends rsync openssh-client
           fi
 
-      - name: Deploy via lftp (mirror over SFTP)
+      - name: Deploy via rsync
         env:
           SFTP_USER: ${{ secrets.SFTP_USER }}
           SFTP_HOST: ${{ secrets.SFTP_HOST }}
           SFTP_PATH: ${{ secrets.SFTP_PATH }}
         run: |
-          # Fail loudly if any secret is missing — otherwise mirror --delete
+          # Fail loudly if any secret is missing — otherwise rsync --delete
           # could be directed at the SSH user's home root.
           : "${SFTP_USER:?SFTP_USER secret must be set}"
           : "${SFTP_HOST:?SFTP_HOST secret must be set}"
           : "${SFTP_PATH:?SFTP_PATH secret must be set}"
-          # `-u USER,` (with trailing comma = empty password) tells lftp not
-          # to prompt for a password; auth happens via the key passed to ssh
-          # by sftp:connect-program. Heredoc body is unindented so lftp's
-          # parser doesn't mistake leading whitespace for a continuation.
-          # `debug 3` prints the ssh command lftp invokes — useful if this
-          # ever breaks again.
-          lftp <<LFTP
-          debug 3
-          set cmd:fail-exit yes
-          set net:max-retries 1
-          set sftp:connect-program 'ssh -a -x -i $HOME/.ssh/id_ed25519 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts'
-          open -u $SFTP_USER, sftp://$SFTP_HOST
-          mirror --reverse --delete --verbose --parallel=4 dist/ $SFTP_PATH/
-          bye
-          LFTP
+          # Hetzner Webhosting splits SSH into two ports:
+          #   port 22  — SFTP only, no remote command exec
+          #   port 222 — full SSH with shell exec (rsync needs this)
+          # `--rsync-path=/usr/bin/rsync` tells the local rsync where to find
+          # the remote binary on Hetzner's locked-down PATH.
+          # `BatchMode=yes` disables interactive prompts.
+          rsync -avz --delete --rsync-path=/usr/bin/rsync \
+            -e "ssh -p 222 -i $HOME/.ssh/id_ed25519 -o BatchMode=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts" \
+            dist/ "$SFTP_USER@$SFTP_HOST:$SFTP_PATH/"
 
       - name: Post-deploy smoke test
         run: |