fix deploy: install modern Docker CLI, use current token for rotation

- Install Docker 27.5.1 static binary + compose v2 plugin instead
  of ancient docker.io from apt (API 1.41 vs required 1.44)
- Read current GITEA_TOKEN from .env before rotation so the API
  call to change_admin_password uses a valid token, not the derived
  placeholder hash
- Set DOCKER_HOST for the static binary

.woodpecker/deploy.yml

@@ -261,8 +261,12 @@ steps:
       ROOT_KEY:
         from_secret: root_key
     commands:
-      # Install docker CLI for compose + docker exec
+      # Install docker CLI (official static binary, matches host daemon)
-      - apt-get update -qq && apt-get install -y -qq docker.io git >/dev/null 2>&1
+      - apt-get update -qq && apt-get install -y -qq curl git >/dev/null 2>&1
+      - curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz | tar xz -C /usr/local/bin --strip-components=1 docker/docker
+      - curl -fsSL -o /usr/local/bin/docker-compose https://github.com/docker/compose/releases/download/v2.35.1/docker-compose-linux-x86_64 && chmod +x /usr/local/bin/docker-compose
+      - mkdir -p /usr/local/lib/docker/cli-plugins && ln -sf /usr/local/bin/docker-compose /usr/local/lib/docker/cli-plugins/docker-compose
+      - export DOCKER_HOST=unix:///var/run/docker.sock
       - cd /home/kert/stack
       # Pull latest code, preserve .env
       - cp .env .env.bak 2>/dev/null || true

src/api/auth/deploy.py

@@ -134,6 +134,17 @@ def deploy(
     values = derive_all(root_key, commit_sha)
     log.info("Derived %d credentials for commit %s", len(values), commit_sha[:8])
 
+    # Read current GITEA_TOKEN from .env (the one that's actually valid)
+    # The derived token is just a placeholder — real tokens come from the API
+    if env_path.exists():
+        for line in env_path.read_text().splitlines():
+            if line.startswith("GITEA_TOKEN="):
+                current_token = line.partition("=")[2].strip()
+                if current_token:
+                    values["GITEA_TOKEN"] = current_token
+                    log.info("Using current GITEA_TOKEN from .env for rotation")
+                break
+
     # ── Phase 1: Rotate backends FIRST ────────────────────────
     # PostgreSQL
     try: