Adds a GitHub Actions workflow that SSHes into the API droplet on every
push to main and runs deploy.sh (git pull + npm install + systemctl
restart). The deploy key is restricted server-side via a forced-command
in authorized_keys, so it can only ever run that one script.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>