ci: stop Drone from emptying SSH/registry secrets

Same $$ escape as tracker so deploy ssh gets real secret env values.

.drone.yml

@@ -164,13 +164,15 @@ steps:
       - apk add --no-cache openssh-client
       - mkdir -p /root/.ssh && chmod 700 /root/.ssh
       - printenv SSH_KEY > /root/.ssh/id_ed25519 && chmod 600 /root/.ssh/id_ed25519
+      # Drone pre-expands ${VAR} (empty for secrets). Use $$ so the shell
+      # reads the from_secret environment at runtime. DRONE_* stay as ${}.
       - |
         ssh -i /root/.ssh/id_ed25519 \
-          -p "${SSH_PORT:-22}" \
+          -p "$${SSH_PORT:-22}" \
           -o StrictHostKeyChecking=accept-new \
           -o BatchMode=yes \
-          "${SSH_USER}@${SSH_HOST}" \
-          "export DRONE_COMMIT_SHA='${DRONE_COMMIT_SHA}' REGISTRY_USERNAME='${REGISTRY_USERNAME}' REGISTRY_PASSWORD='${REGISTRY_PASSWORD}'; bash -s" <<'EOS'
+          "$${SSH_USER}@$${SSH_HOST}" \
+          "export DRONE_COMMIT_SHA='${DRONE_COMMIT_SHA}' REGISTRY_USERNAME='$${REGISTRY_USERNAME}' REGISTRY_PASSWORD='$${REGISTRY_PASSWORD}'; bash -s" <<'EOS'
         set -euo pipefail
         cd /opt/iled-shop
         git fetch origin