chore(devops): env sync to server + SERVICE_ENV secret for CD (parked, not merged)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

infra/deploy/deploy.sh

@@ -20,11 +20,18 @@ retry() { local n=0; until "$@"; do n=$((n + 1)); [ $n -ge 5 ] && return 1; echo
 echo "deploy $REF ($SHA) -> $HOST:$DIR"
 # shellcheck disable=SC2086
 retry scp -q $OPTS "$TGZ" "$HOST:$DIR/release.tgz"
+# Service variables managed via the SERVICE_ENV secret (infra/deploy/env-sync.sh) — merged before the restart.
+if [ -n "${SERVICE_ENV_FILE:-}" ] && [ -s "$SERVICE_ENV_FILE" ]; then
+  # shellcheck disable=SC2086
+  retry scp -q $OPTS "$SERVICE_ENV_FILE" "$HOST:$DIR/service.env"
+fi
 # shellcheck disable=SC2086
 retry ssh $OPTS "$HOST" "bash -s" <<SH
 set -euo pipefail
 cd $DIR
 rm -rf app.new && mkdir app.new && tar -xzf release.tgz -C app.new && rm -f release.tgz
+cp app.new/infra/deploy/env_merge.py env_merge.py
+if [ -s service.env ]; then rc=0; python3 env_merge.py .env service.env || rc=\$?; rm -f service.env; [ "\$rc" = 0 ] || [ "\$rc" = 3 ]; fi
 cp .env app.new/.env
 rm -rf app.old; [ -d app ] && mv app app.old; mv app.new app
 chmod 755 $DIR