deploy: remove the CI pipeline; deploys are manual

No runner was ever active, so the pipeline never ran. Removes
.gitea/workflows/deploy.yml and the CI key and runner IP from
host/bootstrap.sh (a re-run removes the key an earlier bootstrap installed).
The README makes "Manual deploy" the one documented procedure: commit on main,
shellcheck in Docker (-S warning; the pipeline's lint step), git archive over
root SSH, deploy.sh as user deploy, the outside checks, then push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

host/bootstrap.sh

@@ -2,27 +2,17 @@
 # One-time host preparation for the petrolyst server (Ubuntu 24.04), run as root.
 # Idempotent: re-running converges to the same state.
 #
-#   bootstrap.sh --ci-key <public-key-file> --runner-ip <ip|any>
+#   bootstrap.sh
 #
-# --ci-key     public half of the dedicated CI deploy key (DEPLOY_SSH_KEY in Gitea)
-# --runner-ip  egress IP of the Gitea act_runner; the deploy key works only from
-#              there ("any" drops that restriction, e.g. before the runner exists)
+# Deploys are manual: a person runs them over root SSH, and root hands over to
+# the deploy user (README, "Manual deploy"). There is no CI runner, so deploy
+# has no SSH key of its own.
 set -euo pipefail
 
 die() { echo "ERROR: $*" >&2; exit 1; }
 [ "$(id -u)" = 0 ] || die "run as root"
 
-ci_key='' runner_ip=''
-while [ $# -gt 0 ]; do
-  case $1 in
-    --ci-key) ci_key=$2; shift 2 ;;
-    --runner-ip) runner_ip=$2; shift 2 ;;
-    *) die "unknown argument $1" ;;
-  esac
-done
-[ -s "$ci_key" ] || die "--ci-key <public-key-file> is required"
-[ -n "$runner_ip" ] || die "--runner-ip <ip|any> is required"
-grep -qE '^ssh-(ed25519|rsa) ' "$ci_key" || die "$ci_key does not look like an SSH public key"
+[ $# -eq 0 ] || die "bootstrap.sh takes no arguments (deploys are manual; there is no CI key)"
 
 ROOT=/opt/petrolyst
 
@@ -69,15 +59,10 @@ ufw default allow outgoing >/dev/null
 for port in 22 80 443; do ufw allow "$port/tcp" >/dev/null; done
 ufw --force enable >/dev/null
 
-echo "== deploy user (CI)"
+echo "== deploy user (runs deploy.sh; reached only through sudo from root)"
 id deploy >/dev/null 2>&1 || useradd --create-home --shell /bin/bash deploy
-usermod -aG docker deploy # docker access makes deploy root-equivalent; the key restrictions below matter
-install -d -o deploy -g deploy -m 0700 /home/deploy/.ssh
-options=restrict
-[ "$runner_ip" = any ] || options="restrict,from=\"$runner_ip\""
-printf '%s %s\n' "$options" "$(cat "$ci_key")" >/home/deploy/.ssh/authorized_keys
-chown deploy:deploy /home/deploy/.ssh/authorized_keys
-chmod 0600 /home/deploy/.ssh/authorized_keys
+usermod -aG docker deploy # docker access makes deploy root-equivalent, so it gets no SSH key
+rm -f /home/deploy/.ssh/authorized_keys # the former CI key, if an earlier bootstrap installed it
 
 echo "== SSH: keys only"
 [ -s /root/.ssh/authorized_keys ] || die "root has no authorized_keys; refusing to turn off password login"