ci: add staging deploy workflow for terry-wallet-login

- trigger on push to terry-wallet-login
- deploys to staging server via STAGING_* secrets
- rsync to /var/www/ark-library-staging/, sha256 verify

.gitea/workflows/deploy-staging.yml

@@ -0,0 +1,103 @@
+name: Deploy Staging (terry-wallet-login)
+
+on:
+  push:
+    branches:
+      - terry-wallet-login
+
+jobs:
+  deploy:
+    runs-on: self-hosted
+
+    steps:
+      - name: Free disk space
+        run: |
+          set +e
+          echo "=== Disk before cleanup ==="
+          df -h
+          if [ -d "$HOME/.cache/act" ]; then
+            du -sh "$HOME/.cache/act" 2>/dev/null
+            find "$HOME/.cache/act" -mindepth 1 -maxdepth 1 -type d -mmin +60 -exec rm -rf {} + 2>/dev/null
+          fi
+          for dir in "$HOME/actions-runner/_work" "$HOME/.cache/setup-node" "$HOME/.npm/_cacache"; do
+            if [ -d "$dir" ]; then
+              find "$dir" -mindepth 1 -maxdepth 2 -mmin +1440 -exec rm -rf {} + 2>/dev/null
+            fi
+          done
+          if command -v docker >/dev/null 2>&1; then
+            docker image prune -af --filter "until=24h" 2>/dev/null
+            docker container prune -f --filter "until=24h" 2>/dev/null
+            docker builder prune -af --filter "until=24h" 2>/dev/null
+          fi
+          find /tmp -mindepth 1 -maxdepth 1 -mmin +120 \
+            -not -name 'runner*' -not -name 'act*' \
+            -exec rm -rf {} + 2>/dev/null
+          echo "=== Disk after cleanup ==="
+          df -h
+          exit 0
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type check
+        run: npx tsc --noEmit
+
+      - name: Format check
+        run: npm run format:check
+
+      - name: Test
+        run: npm test
+
+      - name: Build
+        run: npm run build
+        env:
+          VITE_API_URL: ""
+          VITE_API_PREFIX: "/apnew"
+          VITE_DISABLE_ADMIN: "true"
+
+      - name: Setup SSH key
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.STAGING_SSH_KEY }}" > ~/.ssh/staging_key
+          chmod 600 ~/.ssh/staging_key
+          ssh-keyscan -H ${{ secrets.STAGING_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
+
+      - name: Deploy to staging server
+        run: |
+          set -euo pipefail
+          HOST="${{ secrets.STAGING_HOST }}"
+          USER="${{ secrets.STAGING_USER }}"
+          echo ">>> 部署到 staging $USER@$HOST"
+          rsync -avz --delete \
+            -e "ssh -i ~/.ssh/staging_key -o StrictHostKeyChecking=no" \
+            dist/ \
+            "${USER}@${HOST}:/var/www/ark-library-staging/"
+          echo ">>> staging 部署完成"
+
+      - name: Verify staging server matches local build
+        run: |
+          set -euo pipefail
+          LOCAL=$(sha256sum dist/index.html | awk '{print $1}')
+          REMOTE=$(ssh -i ~/.ssh/staging_key -o StrictHostKeyChecking=no \
+            ${{ secrets.STAGING_USER }}@${{ secrets.STAGING_HOST }} \
+            "sha256sum /var/www/ark-library-staging/index.html | awk '{print \$1}'")
+          echo "local:   $LOCAL"
+          echo "staging: $REMOTE"
+          if [ "$REMOTE" != "$LOCAL" ]; then
+            echo "ERROR: staging 不是本次构建的版本"
+            exit 1
+          fi
+          echo "✓ staging 已经更新到本次构建的版本。"
+
+      - name: Cleanup SSH key
+        if: always()
+        run: rm -f ~/.ssh/staging_key