feat: add SSH deploy step after Docker build

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/build.yaml

@@ -52,4 +52,38 @@ jobs:
           echo "Pushing ${{ github.ref_name }}..."
           docker push git.viaeon.com/admin/verify:${{ github.ref_name }} 2>&1
           echo "Pushing latest..."
-          docker push git.viaeon.com/admin/verify:latest 2>&1
+          docker push git.viaeon.com/admin/verify:latest 2>&1
+
+  deploy:
+    name: Deploy to Server
+    runs-on: act-runner-4c6g
+    needs: build-and-push
+    env:
+      RUNNER_TOOL_CACHE: /toolcache
+
+    steps:
+      - name: Install SSH client
+        run: |
+          if ! command -v ssh &> /dev/null; then
+            if command -v apk &> /dev/null; then
+              apk add --no-cache openssh-client
+            elif command -v apt-get &> /dev/null; then
+              apt-get update && apt-get install -y openssh-client
+            fi
+          fi
+
+      - name: Setup SSH key
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.DEPLOY_KEY }}" > ~/.ssh/id_rsa
+          chmod 600 ~/.ssh/id_rsa
+          ssh-keyscan -H ${{ secrets.DEPLOY_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
+
+      - name: Deploy via SSH
+        run: |
+          ssh -o StrictHostKeyChecking=no ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }} << 'ENDSSH'
+            cd ${{ secrets.DEPLOY_PATH }}
+            docker compose pull
+            docker compose up -d --remove-orphans
+            docker image prune -f
+          ENDSSH