fix(ci): artifact@v4, AUTH_GOOGLE_SECRET secret, REDIS_HOST + Telegram dans deploy.yaml

ci.yaml:
- upload/download-artifact v3 → v4 (Gitea/Forgejo compatibilité)
- AUTH_GOOGLE_SECRET: vars → secrets (Google OAuth était cassé en prod)

deploy.yaml:
- Ajout REDIS_HOST=redis (manquant → Redis inaccessible au démarrage manuel)
- Ajout TELEGRAM_BOT_TOKEN + TELEGRAM_CHAT_ID (notifications manquantes)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.gitea/workflows/ci.yaml

@@ -103,7 +103,7 @@ jobs:
 
       - name: Upload web artifact
         if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         continue-on-error: true
         with:
           name: web-artifact
@@ -125,7 +125,7 @@ jobs:
           git reset --hard origin/main
 
       - name: Download web artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         continue-on-error: true
         with:
           name: web-artifact
@@ -166,7 +166,7 @@ jobs:
           BRAVE_SEARCH_API_KEY: ${{ secrets.BRAVE_SEARCH_API_KEY }}
           JINA_API_KEY:         ${{ secrets.JINA_API_KEY }}
           AUTH_GOOGLE_ID:       ${{ vars.AUTH_GOOGLE_ID }}
-          AUTH_GOOGLE_SECRET:   ${{ vars.AUTH_GOOGLE_SECRET }}
+          AUTH_GOOGLE_SECRET:   ${{ secrets.AUTH_GOOGLE_SECRET }}
           SOCKET_INTERNAL_KEY:  ${{ secrets.SOCKET_INTERNAL_KEY }}
           SOCKET_PORT:          ${{ vars.SOCKET_PORT }}
           SOCKET_HTTP_PORT:     ${{ vars.SOCKET_HTTP_PORT }}