disable auto-deploy: manual only until rootless Docker issues resolved

The deploy step running docker compose from inside a CI container
causes cascading failures on rootless Docker:
- Container recreation breaks network attachments (DNS misbehaving)
- RustFS IAM corruption on unclean shutdown
- Password rotation without service restart = auth mismatch

Deploy is now a no-op that prints instructions for manual deployment.
Build, scan, and CI quality gates still run automatically.
Manual deploy instructions in the step comments.

refs #118

.woodpecker/deploy.yml

@@ -245,44 +245,25 @@ steps:
       - scan-docs
       - scan-api
 
-  # ── Deploy + Provision (two-phase) ─────────────────────────────
-  # Phase 1: rotate backend passwords (ALTER ROLE, Gitea API)
-  # Phase 2: write .env + docker compose up (services read matching passwords)
-  # Phase 3: sync Woodpecker secrets + health check + rollback on failure
+  # ── Deploy (disabled — manual only) ────────────────────────────
+  # Deploy is disabled until rootless Docker compose-from-CI issues
+  # are resolved. Run manually: docker compose up -d
+  # See Gitea issue #118 (RCA) for details.
+  #
+  # To deploy manually after a green pipeline:
+  #   cd /home/kert/stack
+  #   TAG=sha-$(git rev-parse --short HEAD)
+  #   FQDN=gitea.homelab.fhirworx.io
+  #   for SVC in notebooks zotero docs api mc; do
+  #     docker pull $FQDN/homelab/$SVC:$TAG &&
+  #     docker tag  $FQDN/homelab/$SVC:$TAG fhirworx/$SVC:$TAG
+  #   done
+  #   sed -i "s/^COMMIT_SHA=.*/COMMIT_SHA=$TAG/" .env
+  #   docker compose up -d notebooks zotero docs api mc
   - name: deploy
-    image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
-    volumes:
-      - /run/user/1000/docker.sock:/var/run/docker.sock
-      - /home/kert/stack:/home/kert/stack
-    environment:
-      UV_PYTHON_PREFERENCE: only-system
-      UV_LINK_MODE: copy
-      UV_PROJECT_ENVIRONMENT: .venv
-      ROOT_KEY:
-        from_secret: root_key
+    image: alpine:3
     commands:
-      # Install docker CLI (official static binary, matches host daemon)
-      - apt-get update -qq && apt-get install -y -qq curl git >/dev/null 2>&1
-      - curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz | tar xz -C /usr/local/bin --strip-components=1 docker/docker
-      - curl -fsSL -o /usr/local/bin/docker-compose https://github.com/docker/compose/releases/download/v2.35.1/docker-compose-linux-x86_64 && chmod +x /usr/local/bin/docker-compose
-      - mkdir -p /usr/local/lib/docker/cli-plugins && ln -sf /usr/local/bin/docker-compose /usr/local/lib/docker/cli-plugins/docker-compose
-      - export DOCKER_HOST=unix:///var/run/docker.sock
-      - cd /home/kert/stack
-      # Pull latest code, preserve .env
-      - cp .env .env.bak 2>/dev/null || true
-      - git fetch http://gitea:3000/homelab/stack.git main
-      - git reset --hard FETCH_HEAD
-      - cp .env.bak .env 2>/dev/null || true
-      # Retag registry images for compose
-      - TAG=sha-${CI_COMMIT_SHA:0:8}
-      - FQDN=gitea.homelab.fhirworx.io
-      - for SVC in notebooks zotero docs api mc; do
-          docker pull $FQDN/homelab/$SVC:$TAG &&
-          docker tag  $FQDN/homelab/$SVC:$TAG fhirworx/$SVC:$TAG || true;
-        done
-      # Two-phase provision + restart + health check
-      - uv sync --no-dev
-      - uv run python -m api.auth deploy ${CI_COMMIT_SHA}
+      - echo "Deploy disabled — run manually after green pipeline"
     depends_on:
       - publish-package
       - scan-notebooks