Fix Gitea CI deploy path and ban production hot-patches.

Drop the flaky host Node docker step (image build already runs Vite), hard-reset the deploy checkout to the CI SHA, and fail deploy if assets still emit http://.

scripts/deploy-production.sh

@@ -8,7 +8,8 @@ Deploy a pre-built APP_IMAGE to one or more AndyTranscribe directories.
 Environment:
   APP_IMAGE       Required. e.g. gitea.z00.nu/ben/andytranscribe:abc1234
   DEPLOY_PATHS    Comma-separated instance directories (default: current directory)
-  GIT_PULL        When 1 (default), run git pull --ff-only in each directory first
+  DEPLOY_SHA      Optional git SHA to hard-reset each directory to (CI sets this)
+  GIT_PULL        When 1 (default) and DEPLOY_SHA is empty, run git pull --ff-only
 
 Usage:
   APP_IMAGE=gitea.z00.nu/ben/andytranscribe:tag DEPLOY_PATHS=$HOME/andyTranscibe ./scripts/deploy-production.sh
@@ -23,6 +24,7 @@ fi
 
 PATHS_CSV="${DEPLOY_PATHS:-${2:-.}}"
 GIT_PULL="${GIT_PULL:-1}"
+DEPLOY_SHA="${DEPLOY_SHA:-}"
 IFS=',' read -r -a DIRS <<< "${PATHS_CSV}"
 
 for dir in "${DIRS[@]}"; do
@@ -40,8 +42,20 @@ for dir in "${DIRS[@]}"; do
     (
         cd "${dir}"
 
-        if [[ "${GIT_PULL}" == "1" ]] && git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
-            git pull --ff-only
+        if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+            if [[ -n "${DEPLOY_SHA}" ]]; then
+                git fetch --force origin "${DEPLOY_SHA}"
+                git checkout --force --detach "${DEPLOY_SHA}"
+                git reset --hard "${DEPLOY_SHA}"
+                # Drop local edits/hot-patches; keep runtime data and secrets.
+                git clean -fd \
+                    --exclude=database/ \
+                    --exclude=storage/ \
+                    --exclude=.env \
+                    --exclude=.env.*
+            elif [[ "${GIT_PULL}" == "1" ]]; then
+                git pull --ff-only
+            fi
         fi
 
         export APP_IMAGE="${IMAGE}"
@@ -59,7 +73,7 @@ for dir in "${DIRS[@]}"; do
         fi
 
         docker compose "${compose_files[@]}" pull app queue reverb
-        docker compose "${compose_files[@]}" up -d
+        docker compose "${compose_files[@]}" up -d --remove-orphans
         docker compose "${compose_files[@]}" ps
 
         app_port="$(awk -F= '/^APP_HOST_PORT=/ {print $2; exit}' .env 2>/dev/null || true)"
@@ -79,6 +93,13 @@ for dir in "${DIRS[@]}"; do
             echo "ERROR: health check failed for ${name}" >&2
             exit 1
         fi
+
+        asset_scheme="$(curl -fsS "${health_url%/up}/login" | grep -oE 'https?://[^"'\'' ]+\.css' | head -1 || true)"
+        if [[ "${asset_scheme}" == http://* ]]; then
+            echo "ERROR: login page still emits http:// asset URLs (${asset_scheme})" >&2
+            exit 1
+        fi
+        echo "asset check ok: ${asset_scheme:-no absolute css url (relative/ok)}"
     )
 done