Add a Coolify deploy workflow, gated on green CI

.github/workflows/deploy.yml

@@ -0,0 +1,102 @@
+name: deploy
+
+# Deploy for the foaf-protocol tiers. Each tier is a Coolify app on the Contabo
+# box (144.126.145.4) tracking this repo's `main`; a deploy asks Coolify to
+# pull latest and rebuild.
+#
+#   prod   api.foaf.io   (manual dispatch, needs confirm=deploy-prod-protocol)
+#   demo   dpi.foaf.io   (auto, after CI goes green on main)
+#   beta   bpi.foaf.io   (manual dispatch)
+#
+# Secret: COOLIFY_API_TOKEN (Coolify API bearer).
+#
+# THIS WORKFLOW IS THE ONLY DEPLOY PATH, AND THAT IS LOAD-BEARING.
+# Coolify has a per-app "auto deploy on git push" setting that is invisible
+# from this repo. It was ON for all three tiers until 2026-09-26, which meant
+# every merge to `main` rebuilt PRODUCTION immediately, with no gate anywhere
+# in the repo and no way to tell from the code. It is now OFF for prod, demo
+# and beta, which is what makes the prod confirm below real rather than
+# decorative. The absence of a deploy workflow was never the absence of a
+# deploy trigger.
+#
+# If prod ever starts deploying on merge again, check that setting first:
+#   curl -s https://coolify.rheo.ca/api/v1/applications/<uuid> \
+#     -H "Authorization: Bearer $COOLIFY_API_TOKEN" \
+#     | python3 -c 'import sys,json;print(json.load(sys.stdin)["settings"]["is_auto_deploy_enabled"])'
+# Turn it back off with a PATCH of {"is_auto_deploy_enabled": false}.
+#
+# Talks to the Coolify API directly over HTTPS at coolify.rheo.ca, which is
+# published through Traefik, so no SSH key is needed on the runner.
+
+on:
+  # Demo deploys only after the suite is green on main. A push trigger would
+  # deploy red commits, which is the failure CI exists to prevent.
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      tier:
+        description: "Tier to deploy"
+        required: true
+        type: choice
+        options: [demo, beta, prod]
+      confirm:
+        description: "Type deploy-prod-protocol to allow a prod deploy"
+        required: false
+        type: string
+
+concurrency:
+  group: deploy-${{ github.event.inputs.tier || 'demo' }}
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      github.event.workflow_run.conclusion == 'success'
+    steps:
+      - name: Resolve tier and guard prod
+        id: tier
+        run: |
+          set -euo pipefail
+          TIER="${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tier || 'demo' }}"
+          if [ "$TIER" = "prod" ] && [ "${{ github.event.inputs.confirm }}" != "deploy-prod-protocol" ]; then
+            echo "::error::Refusing prod deploy without confirm=deploy-prod-protocol"
+            exit 1
+          fi
+          case "$TIER" in
+            prod) UUID="kvnksiwym19qm62iaygggfhs" ;;
+            demo) UUID="zu1wmibhfvizact7cwh7dfm6" ;;
+            beta) UUID="kwsr62yqupxe4w4u22n0xipp" ;;
+            *) echo "::error::Unknown tier $TIER"; exit 1 ;;
+          esac
+          echo "tier=$TIER" >> "$GITHUB_OUTPUT"
+          echo "uuid=$UUID" >> "$GITHUB_OUTPUT"
+          echo "Deploying tier=$TIER uuid=$UUID" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Trigger Coolify deploy and wait
+        env:
+          CT: ${{ secrets.COOLIFY_API_TOKEN }}
+          TIER: ${{ steps.tier.outputs.tier }}
+          UUID: ${{ steps.tier.outputs.uuid }}
+        run: |
+          set -euo pipefail
+          api() { curl -sf -m 30 -X "$1" "https://coolify.rheo.ca/api/v1/$2" -H "Authorization: Bearer $CT"; }
+          RESP=$(api POST "deploy?uuid=$UUID")
+          echo "$RESP"
+          DEP=$(echo "$RESP" | python3 -c "import sys,json;print(json.load(sys.stdin)['deployments'][0]['deployment_uuid'])")
+          echo "deployment=$DEP"
+          for i in $(seq 1 90); do
+            sleep 10
+            DS=$(api GET "deployments/$DEP" | python3 -c "import sys,json;print(json.load(sys.stdin).get('status','?'))" 2>/dev/null || echo "poll-failed")
+            echo "[$i] status=$DS"
+            case "$DS" in
+              finished) echo "✅ $TIER deployed ($DEP)" >> "$GITHUB_STEP_SUMMARY"; exit 0 ;;
+              failed|cancelled*) echo "::error::Deployment $DS — see Coolify deployment $DEP"; exit 1 ;;
+            esac
+          done
+          echo "::error::Timed out after 15 minutes waiting on deployment $DEP"
+          exit 1