ci: take the deploy target out of the public workflow

This repo is public, so .gitea/workflows/ci.yml was publishing the web
host's tailnet address in a plaintext env: block, together with the deploy
account, the checkout path and the unit restarted under sudo -- a complete
map of the deploy for any anonymous reader.

Host, account, path and service now come from repo secrets (DEPLOY_HOST,
DEPLOY_USER, DEPLOY_PATH, DEPLOY_SERVICE), which Gitea masks in run logs.
The path and unit name are passed to the remote shell as positional args
inside a quoted heredoc so they are never interpolated into the log either.
The deploy key secret is renamed CLOUD2_SSH_KEY -> DEPLOY_SSH_KEY to match;
it was never actually set, which is why every deploy run so far is red.

The rest of docs/DEPLOY.md already used the web-host/build-host pseudonyms;
this drops the remaining absolute deploy-account paths from its prose.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012AaUFYkUTsJn1fnJ89qbvW

docs/DEPLOY.md

@@ -12,7 +12,7 @@ What that leaves on the box:
 - Caddy vhost for `bench.karti.ai` is now `redir https://lumbridgecorp.com/bench permanent`
   (a pre-change Caddyfile backup is at `/etc/caddy/Caddyfile.bak-bench-<timestamp>`)
 - DNS `bench.karti.ai A 170.9.14.61` and the Let's Encrypt cert stay — the redirect needs both
-- checkout at `/home/ubuntu/workspace/bench.karti.ai` remains, now on `origin` =
+- checkout at `~/workspace/bench.karti.ai` remains, now on `origin` =
   `karti/lumbridge-bench`; the `bench-karti` unit is stopped and disabled, not removed
 
 **To bring a Bench UI back up**, deploy it as part of Lumbridge rather than reviving the subdomain.
@@ -45,13 +45,13 @@ forever. Either add the `www` records or drop them from their vhosts.
 | repo | `karti/lumbridge-bench` on gitea, **private** |
 | host | web-host, port **8909** |
 | service | `bench-karti` compatibility service (systemd) |
-| checkout | `/home/ubuntu/workspace/bench.karti.ai` compatibility path |
+| checkout | `~/workspace/bench.karti.ai` compatibility path |
 | domain | `bench.karti.ai` → web-host, DNS via oci on build-host (profile `cloud2-sanjose`) |
 
 ## One-time setup on web-host
 
 ```bash
-cd /home/ubuntu/workspace
+cd ~/workspace
 git clone https://gitea.example.internal:8444/karti/lumbridge-bench.git bench.karti.ai
 cd bench.karti.ai/site
 cp .env.example .env.local   # loopback Lumbridge control plane