feat(cd): add continuous deployment on push to master

Deploy job SSHes to production after ruff/pytest/architecture pass,
running scripts/deploy.sh (stash, pull, docker rebuild, migrate, health check).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/deploy.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# =============================================================================
+# Wizamart Production Deploy Script
+# =============================================================================
+# Usage: cd ~/apps/orion && bash scripts/deploy.sh
+#
+# Called by Gitea Actions CD pipeline (appleboy/ssh-action) or manually.
+#
+# Exit codes:
+#   0 — success
+#   1 — git pull failed
+#   2 — docker compose build/up failed
+#   3 — alembic migration failed
+#   4 — health check failed
+# =============================================================================
+
+set -euo pipefail
+
+COMPOSE="docker compose --profile full"
+HEALTH_URL="http://localhost:8001/health"
+HEALTH_RETRIES=12
+HEALTH_INTERVAL=5
+
+log() { echo "[deploy] $(date '+%H:%M:%S') $*"; }
+
+# ── 1. Pull latest code (stash local changes like .env) ─────────────────────
+log "Stashing local changes …"
+git stash --include-untracked --quiet || true
+
+log "Pulling latest code …"
+if ! git pull --ff-only; then
+    log "ERROR: git pull failed"
+    git stash pop --quiet 2>/dev/null || true
+    exit 1
+fi
+
+log "Restoring local changes …"
+git stash pop --quiet 2>/dev/null || true
+
+# ── 2. Rebuild and restart containers ────────────────────────────────────────
+log "Rebuilding containers …"
+if ! $COMPOSE up -d --build; then
+    log "ERROR: docker compose up failed"
+    exit 2
+fi
+
+# ── 3. Run database migrations ───────────────────────────────────────────────
+log "Running database migrations …"
+if ! $COMPOSE exec -T -e PYTHONPATH=/app api python -m alembic upgrade heads; then
+    log "ERROR: alembic migration failed"
+    exit 3
+fi
+
+# ── 4. Health check with retries ─────────────────────────────────────────────
+log "Waiting for health check ($HEALTH_URL) …"
+for i in $(seq 1 "$HEALTH_RETRIES"); do
+    if curl -sf "$HEALTH_URL" > /dev/null 2>&1; then
+        log "Health check passed (attempt $i/$HEALTH_RETRIES)"
+        log "Deploy complete."
+        exit 0
+    fi
+    log "Health check attempt $i/$HEALTH_RETRIES failed, retrying in ${HEALTH_INTERVAL}s …"
+    sleep "$HEALTH_INTERVAL"
+done
+
+log "ERROR: health check failed after $HEALTH_RETRIES attempts"
+exit 4