New api.auth.deploy module implements the correct rotation order:
1. derive_all() → new passwords
2. provision_postgres() → ALTER ROLE (backend first)
3. provision_gitea() → rotate token via API
4. write_env() → write .env with matching passwords
5. docker compose up -d → services read correct passwords
6. provision_woodpecker() → sync CI secrets
7. verify_all() → health check postgres/gitea/rustfs
8. rollback to .env.bak if health checks fail
Merged deploy + provision into single Woodpecker step to eliminate
the race between git reset and .env writes.
CLI: uv run python -m api.auth deploy <sha>
CLI: uv run python -m api.auth verify <sha>
13 tests covering health checks, two-phase rotation, rollback,
and partial failure scenarios.
fix#119fix#120fix#121fix#122
8d9c89952a
