decouple provision from deploy step fix #108

Provision now depends on build steps directly instead of deploy.
Scan/upload/deploy failures no longer cascade-skip provision.
Added failure: ignore so provision errors don't mask build status.

.woodpecker/deploy.yml

@@ -276,8 +276,11 @@ steps:
       - build-push-mc
 
   # ── Provision: derive credentials and rotate backends ────────
+  # Runs after deploy but also after builds — decoupled so that
+  # scan/upload failures don't prevent credential rotation.
   - name: provision
     image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+    failure: ignore
     volumes:
       - /run/user/1000/docker.sock:/var/run/docker.sock
       - /home/kert/stack:/home/kert/stack
@@ -288,7 +291,11 @@ steps:
       - cd /home/kert/stack
       - uv run python -m api.auth provision ${CI_COMMIT_SHA}
     depends_on:
-      - deploy
+      - build-push-notebooks
+      - build-push-zotero
+      - build-push-docs
+      - build-push-api
+      - build-push-mc
 
   # ── Failure reporter ─────────────────────────────────────────
   - name: report-failure