net10, pointed at PrivaPub, and deployed as a static site to decepub.thepra.dev

The project referenced ../SocialPub/SocialPub/SocialPub.ClientModels, a path
that has not existed since the server became PrivaPub; it references
../SocialPub/PrivaPub.ClientModels now, and CI clones SocialPub beside it.

Retargeted to net10.0 with the Microsoft packages at 10.0.9.
BlazorDownloadFileFast moves to 1.0.0.1 because 0.2.0 used
IJSUnmarshalledRuntime, which .NET 9 removed. The Visual Studio bundler and
web compiler packages are gone; the bundle they produced, css/style.min.css,
is committed and stays the stylesheet, and its stale .gz is deleted because
.NET's static-asset compression writes that path itself.

AppConfiguration.ApiBaseAddress (https://privapub.thepra.dev) is the API
client's base address; the template's placeholder OIDC section and the
Toolbelt.Blazor.HotKeys script tag, whose package is not referenced, are
removed. The vhost sends noindex while the feed shows the prototype's mock
posts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

.gitea/workflows/deploy.yml

@@ -0,0 +1,72 @@
+name: Deploy
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - 'v*'
+
+env:
+  WEB_ROOT: /var/www/decepub.thepra.dev
+  BACKUPS: /var/backups/decepub.thepra.dev
+  PUBLIC_URL: https://decepub.thepra.dev
+
+jobs:
+  site:
+    name: decepub.thepra.dev
+    runs-on: build
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: decePubClient
+
+      - name: Fetch PrivaPub's client models beside it
+        env:
+          READ_TOKEN: ${{ secrets.THEPRA_READ_TOKEN }}
+        run: |
+          rm -rf SocialPub
+          git -c http.extraHeader="Authorization: token $READ_TOKEN" clone -q --depth 1 \
+            https://git.thepra.dev/thepra/SocialPub.git SocialPub
+
+      - name: Resolve the build identity
+        run: |
+          echo "BUILD_COMMIT=$(echo "$GITHUB_SHA" | cut -c1-8)" >> "$GITHUB_ENV"
+          echo "BUILD_REF=${GITHUB_REF_NAME:-master}" >> "$GITHUB_ENV"
+          echo "BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_ENV"
+
+      - name: Publish
+        run: |
+          rm -rf "$GITHUB_WORKSPACE/publish"
+          dotnet publish decePubClient/decePubClient.csproj -c Release -o "$GITHUB_WORKSPACE/publish"
+          printf '{"commit":"%s","buildRef":"%s","builtAt":"%s"}\n' "$BUILD_COMMIT" "$BUILD_REF" "$BUILD_TIME" \
+            > "$GITHUB_WORKSPACE/publish/wwwroot/build.json"
+
+      - name: Assert the publish actually produced a site
+        run: |
+          W="$GITHUB_WORKSPACE/publish/wwwroot"
+          for f in index.html appsettings.json build.json _framework/blazor.webassembly.js css/style.min.css; do
+            [ -e "$W/$f" ] || { echo "::error::publish output is missing $f"; exit 1; }
+          done
+          ls "$W/_framework" | grep -q '\.wasm$' || { echo "::error::no .wasm in _framework"; exit 1; }
+          echo "publish OK, $(du -sh "$W" | cut -f1)"
+
+      - name: Snapshot the live directory
+        run: |
+          STAMP=$(date +%Y%m%d-%H%M%S)
+          rsync -a "$WEB_ROOT/" "$BACKUPS/site-$STAMP/"
+          echo "SNAPSHOT=$BACKUPS/site-$STAMP" >> "$GITHUB_ENV"
+          ls -1dt "$BACKUPS"/site-* 2>/dev/null | tail -n +4 | xargs -r rm -rf || true
+
+      - name: Sync
+        run: rsync -a --delete "$GITHUB_WORKSPACE/publish/wwwroot/" "$WEB_ROOT/"
+
+      - name: Verify what is being served, roll back on failure
+        run: |
+          served=$(curl -fsS "$PUBLIC_URL/build.json" | python3 -c "import json,sys; print(json.load(sys.stdin).get('commit',''))" || true)
+          code=$(curl -s -o /dev/null -w '%{http_code}' "$PUBLIC_URL/some/client/route")
+          if [ "$served" != "$BUILD_COMMIT" ] || [ "$code" != "200" ]; then
+            echo "::error::served build '$served' (expected '$BUILD_COMMIT'), fallback route answered $code - rolling back"
+            rsync -a --delete "$SNAPSHOT/" "$WEB_ROOT/"
+            exit 1
+          fi
+          echo "::notice::serving $served"