Add deploy-demo workflow for persistent Hetzner demo

[tislib]

Summary

New workflow_dispatch pipeline at .github/workflows/deploy-demo.yml that deploys the roda-ledger demo to a persistent Hetzner Cloud server.

• Job 1 build-images — matrix over control + ui, builds linux/amd64 from the current branch, tags as tislib/roda-ledger:{control,ui}-demo-${{ github.run_id }} (unique per run, no races between concurrent demos), reuses the same GHA cache scopes as docker-publish.yml.
• Job 2 deploy — installs hcloud, generates an SSH key, deletes any prior server/key with the same name (idempotent recreate), creates the new server, installs Docker, curls the branch's docker-compose.control.yml, seds the :latest tags to point at the demo build, writes a docker-compose.override.yml that sets CONTROL_PLANE_URL=http://<public-ip>:50051 so the UI works remotely, and runs docker compose up -d. No auto-destroy at the end.
• Step summary prints the public IP, demo URL (http://<ip>:8080), gRPC endpoint, image tags, and the manual destroy commands.

Inputs

Input	Default	Notes
server_name	roda-ledger-demo	Used as the Hetzner server name AND the SSH key name. Change it to run multiple demos in parallel.
server_type	cx32	Choice of 14 Hetzner SKUs: cx22/32/42/52, cpx11/21/31/41/51, ccx13/23/33/43/53.

Why curl-then-sed instead of a fresh compose

Deploying from the branch's own docker-compose.control.yml (with minimal sed for tags) means a broken compose surfaces in this pipeline — the same file end-users download with the README's curl | docker compose up flow.

Secrets used (all pre-existing)

HCLOUD_TOKEN, DOCKERHUB_USERNAME, DOCKERHUB_TOKEN.

Non-goals

No firewall/TLS/DNS; demo runs plain HTTP on :8080. No auto-destroy (a separate destroy-demo.yml can be added later). Location pinned to fsn1 to match the other Hetzner workflows. No multi-arch image build — Hetzner CX is x86.

Test plan

• Trigger "Deploy Demo" from the Actions UI with all defaults — both jobs go green; step summary shows a public IP; http://<ip>:8080 loads the UI and shows a 3-node cluster; grpcurl -plaintext <ip>:50051 list enumerates roda.ledger.v1.Ledger.
• Re-run with the same defaults — confirm the prior roda-ledger-demo is destroyed and replaced (new public IP).
• Run with server_name: roda-ledger-demo-2 — confirm both servers coexist (hcloud server list).
• Run with server_type: cx22 — confirm the smaller size still boots the demo.
• Run from a feature branch with a deliberate UI change — confirm the deployed UI reflects the branch (proves the build-from-branch path).
• Manually destroy when done: hcloud server delete roda-ledger-demo && hcloud ssh-key delete roda-ledger-demo.

🤖 Generated with Claude Code