ci: install runner on target server, eliminate SSH complexity

Better architecture: act_runner runs directly on 192.168.1.190.
- No SSH keys needed, no secrets to configure in Gitea
- Runner executes docker compose commands locally
- Workflow uses rsync + docker compose build + healthcheck
- Updated DEPLOY.md with complete step-by-step guide

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitea/workflows/deploy.yaml

@@ -7,18 +7,47 @@ on:
 
 jobs:
   deploy:
-    name: Deploy to 192.168.1.190
-    runs-on: ubuntu-latest
+    name: Build and Deploy
+    # "docker-host" label = runs directly on the host (192.168.1.190)
+    runs-on: docker-host
     steps:
-      - name: Deploy via SSH
-        uses: appleboy/ssh-action@v1.2.2
-        with:
-          host: ${{ secrets.DEPLOY_HOST }}
-          username: ${{ secrets.DEPLOY_USER }}
-          key: ${{ secrets.DEPLOY_SSH_KEY }}
-          port: ${{ secrets.DEPLOY_PORT || 22 }}
-          script_stop: true
-          command_timeout: 10m
-          script: |
-            cd ${{ secrets.DEPLOY_PATH }}
-            bash scripts/deploy.sh --build
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Sync code to deploy directory
+        run: |
+          rsync -a --delete \
+            --exclude '.git' \
+            --exclude 'node_modules' \
+            --exclude '.next' \
+            --exclude 'memento-note/node_modules' \
+            --exclude 'mcp-server/node_modules' \
+            ${{ github.workspace }}/ /opt/memento/
+
+      - name: Build and deploy
+        working-directory: /opt/memento
+        run: |
+          set -e
+          docker compose build --parallel
+          docker compose up -d --remove-orphans
+
+      - name: Wait for healthchecks
+        working-directory: /opt/memento
+        run: |
+          echo "Waiting for containers..."
+          for i in $(seq 1 30); do
+            UNHEALTHY=$(docker compose ps --format '{{.Status}}' | grep -cv "healthy" || true)
+            if [ "$UNHEALTHY" -eq 0 ]; then
+              echo "All containers healthy!"
+              docker compose ps
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "Timeout waiting for healthchecks"
+          docker compose ps
+          exit 1
+
+      - name: Cleanup old images
+        if: always()
+        run: docker image prune -f