ci: auto-deploy to droplet on push to main

Adds a GitHub Actions workflow that SSHes into the API droplet on every
push to main and runs deploy.sh (git pull + npm install + systemctl
restart). The deploy key is restricted server-side via a forced-command
in authorized_keys, so it can only ever run that one script.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -0,0 +1,21 @@
+name: Deploy to droplet
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch: {}
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      # The key below is restricted server-side to only run
+      # /opt/new_starr/deploy.sh (see authorized_keys forced-command on the
+      # droplet) — it can't run arbitrary commands even if this secret leaks.
+      - name: Deploy via SSH
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.DEPLOY_HOST }}
+          username: root
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          script: deploy