Keep the deploy target out of the public repo

The workflow named the web host, its address and the web root path, and the
README named the container. Host, user and path now come from repository
variables, and the deploy step fails clearly if one is missing.

Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9

.gitea/workflows/deploy.yml

@@ -39,15 +39,19 @@ jobs:
         run: npm run build
 
       # tar over SSH (the runner image has no rsync). Build is unpacked into
-      # a .new dir on CT148 and atomically swapped in, so the live web root is
-      # never left half-written.
-      - name: Deploy dist/ to CT148 over SSH
+      # a .new dir on the web host and atomically swapped in, so the live web
+      # root is never left half-written. Host, user and path are repository
+      # variables, so no infrastructure details live in the public repo.
+      - name: Deploy dist/ over SSH
         env:
-          DEPLOY_HOST: 192.168.10.148
-          DEPLOY_USER: root
-          DEPLOY_PATH: /var/www/asger
+          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
+          DEPLOY_USER: ${{ vars.DEPLOY_USER }}
+          DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
         run: |
           set -euo pipefail
+          : "${DEPLOY_HOST:?repository variable DEPLOY_HOST is not set}"
+          : "${DEPLOY_USER:?repository variable DEPLOY_USER is not set}"
+          : "${DEPLOY_PATH:?repository variable DEPLOY_PATH is not set}"
           mkdir -p ~/.ssh
           echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key