fix deploy: preserve bootstrap-tier creds from .env, never rotate RustFS

BOOTSTRAP-tier credentials (POSTGRES_PASSWORD, RUSTFS_ACCESS_KEY,
RUSTFS_SECRET_KEY, WOODPECKER_AGENT_SECRET) are set during initial
bootstrap and stored on disk by backends. Rotating them via env vars
crashes RustFS (IAM mismatch) and breaks postgres auth.

deploy.py now reads current .env and overrides all BOOTSTRAP-tier
values in the derived dict, so they're preserved through rotation.
Only SERVICE-tier credentials (per-commit) get new derived values.

src/api/auth/deploy.py

@@ -145,6 +145,21 @@ def deploy(
                 k, _, v = line.partition("=")
                 current_env[k.strip()] = v.strip()
 
+    # Preserve BOOTSTRAP-tier credentials from current .env.
+    # These were set during initial bootstrap and must NOT be rotated
+    # (RustFS stores IAM on disk; changing env vars crashes it).
+    from api.auth.manifest import CREDENTIALS, Provisioner, Tier
+
+    bootstrap_vars = {
+        c.env_var
+        for c in CREDENTIALS
+        if c.tier is Tier.BOOTSTRAP and c.provisioner is not Provisioner.SKIP
+    }
+    for var in bootstrap_vars:
+        if var in current_env:
+            values[var] = current_env[var]
+    log.info("Preserved %d bootstrap-tier credentials from .env", len(bootstrap_vars))
+
     # Use current GITEA_TOKEN (derived one is just a hash placeholder)
     if current_env.get("GITEA_TOKEN"):
         values["GITEA_TOKEN"] = current_env["GITEA_TOKEN"]