fix(ci): artifact@v4, AUTH_GOOGLE_SECRET secret, REDIS_HOST + Telegram dans deploy.yaml

ci.yaml:
- upload/download-artifact v3 → v4 (Gitea/Forgejo compatibilité)
- AUTH_GOOGLE_SECRET: vars → secrets (Google OAuth était cassé en prod)

deploy.yaml:
- Ajout REDIS_HOST=redis (manquant → Redis inaccessible au démarrage manuel)
- Ajout TELEGRAM_BOT_TOKEN + TELEGRAM_CHAT_ID (notifications manquantes)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.gitea/workflows/ci.yaml

@@ -103,7 +103,7 @@ jobs:
 
       - name: Upload web artifact
         if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         continue-on-error: true
         with:
           name: web-artifact
@@ -125,7 +125,7 @@ jobs:
           git reset --hard origin/main
 
       - name: Download web artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         continue-on-error: true
         with:
           name: web-artifact
@@ -166,7 +166,7 @@ jobs:
           BRAVE_SEARCH_API_KEY: ${{ secrets.BRAVE_SEARCH_API_KEY }}
           JINA_API_KEY:         ${{ secrets.JINA_API_KEY }}
           AUTH_GOOGLE_ID:       ${{ vars.AUTH_GOOGLE_ID }}
-          AUTH_GOOGLE_SECRET:   ${{ vars.AUTH_GOOGLE_SECRET }}
+          AUTH_GOOGLE_SECRET:   ${{ secrets.AUTH_GOOGLE_SECRET }}
           SOCKET_INTERNAL_KEY:  ${{ secrets.SOCKET_INTERNAL_KEY }}
           SOCKET_PORT:          ${{ vars.SOCKET_PORT }}
           SOCKET_HTTP_PORT:     ${{ vars.SOCKET_HTTP_PORT }}

.gitea/workflows/deploy.yaml

@@ -59,6 +59,8 @@ jobs:
           SOCKET_HTTP_PORT:     ${{ vars.SOCKET_HTTP_PORT }}
           SOCKET_INTERNAL_URL:  ${{ vars.SOCKET_INTERNAL_URL }}
           NEXT_PUBLIC_SOCKET_URL: ${{ vars.NEXT_PUBLIC_SOCKET_URL }}
+          TELEGRAM_BOT_TOKEN:   ${{ secrets.TELEGRAM_BOT_TOKEN }}
+          TELEGRAM_CHAT_ID:     ${{ secrets.TELEGRAM_CHAT_ID }}
         run: |
           ENV_FILE="/opt/memento/.env.docker"
           touch "$ENV_FILE"
@@ -108,6 +110,9 @@ jobs:
           upsert SOCKET_HTTP_PORT       "$SOCKET_HTTP_PORT"
           upsert SOCKET_INTERNAL_URL    "$SOCKET_INTERNAL_URL"
           upsert NEXT_PUBLIC_SOCKET_URL "$NEXT_PUBLIC_SOCKET_URL"
+          upsert REDIS_HOST             "redis"
+          upsert TELEGRAM_BOT_TOKEN     "$TELEGRAM_BOT_TOKEN"
+          upsert TELEGRAM_CHAT_ID       "$TELEGRAM_CHAT_ID"
 
       - name: Deploy (full build, no CI artifact)
         env: