ci: Decode base64-encoded deploy SSH key

Storing the raw PEM as a secret mangled it (CRLF/whitespace/newline),
causing ssh to fail with "error in libcrypto" at the copy step. Store the
key base64-encoded and decode it in the workflow so the PEM round-trips
intact.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy.yaml

@@ -4,7 +4,10 @@ name: Deploy
 # Caddy host, and restarts the service.
 #
 # Required repo secret:
-#   DEPLOY_SSH_KEY  - private SSH key authorized for ${DEPLOY_USER}@${DEPLOY_HOST}
+#   DEPLOY_SSH_KEY  - base64-encoded private SSH key authorized for
+#                     ${DEPLOY_USER}@${DEPLOY_HOST}. Generate with:
+#                       base64 -w0 < deploy_key      # Linux
+#                       base64 -i deploy_key | tr -d '\n'   # macOS
 #
 # Override host/user/paths via repo variables (Settings > Actions > Variables)
 # if they ever change; the defaults below match the Justfile.
@@ -48,7 +51,10 @@ jobs:
         run: |
           command -v rsync >/dev/null || { apt-get update && apt-get install -y rsync; }
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          install -m 600 /dev/stdin ~/.ssh/deploy_key <<< "${{ secrets.DEPLOY_SSH_KEY }}"
+          # DEPLOY_SSH_KEY is stored base64-encoded so the PEM survives the
+          # secret round-trip intact (no CRLF/whitespace/newline mangling).
+          echo "${{ secrets.DEPLOY_SSH_KEY }}" | base64 -d > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
           ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null
 
       - name: Copy frontend