chore(devops): env sync to server + SERVICE_ENV secret for CD (parked, not merged)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_env_merge.py

@@ -0,0 +1,21 @@
+import importlib.util
+from pathlib import Path
+
+spec = importlib.util.spec_from_file_location("env_merge", Path("infra/deploy/env_merge.py"))
+env_merge = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(env_merge)
+
+
+def test_merge_updates_adds_and_protects(tmp_path):
+    target = tmp_path / "server.env"
+    target.write_text("# server\nPSEUDO_KEY=server-secret\nCHAT_AGENT=off\nTZ=Europe/Moscow\n")
+    source = tmp_path / "service.env"
+    source.write_text("CHAT_AGENT=gigachat\nINTAKE_DEMO=true\nPSEUDO_KEY=evil\nGITEA_TOKEN=x\nEMPTY=\n")
+    changed = env_merge.merge(str(target), str(source))
+    assert sorted(changed) == ["CHAT_AGENT", "INTAKE_DEMO"]
+    text = target.read_text()
+    assert "PSEUDO_KEY=server-secret" in text and "evil" not in text
+    assert "CHAT_AGENT=gigachat" in text and "INTAKE_DEMO=true" in text and "TZ=Europe/Moscow" in text
+    assert "GITEA_TOKEN" not in text and "EMPTY" not in text
+    assert text.startswith("# server\n")
+    assert env_merge.merge(str(target), str(source)) == []  # idempotent