ci: replace appleboy SSH plugin with OpenSSH

appleboy/drone-ssh failed with a local git error when clone is
disabled; alpine + ssh is reliable for Pi deploys.

Co-authored-by: Cursor <cursoragent@cursor.com>

.drone.yml

@@ -142,25 +142,35 @@ concurrency:
   limit: 1
 
 steps:
+  # appleboy/drone-ssh misbehaves with clone:disable (local git error).
+  # Plain OpenSSH from alpine is reliable.
   - name: ssh-deploy
-    image: appleboy/drone-ssh
+    image: alpine:3.20
     pull: false
-    settings:
+    environment:
-      host:
+      SSH_HOST:
         from_secret: ssh_host
-      username:
+      SSH_USER:
         from_secret: ssh_user
-      key:
+      SSH_KEY:
         from_secret: ssh_key
-      port:
+      SSH_PORT:
         from_secret: ssh_port
-      script_stop: true
+      REGISTRY_USERNAME:
-      envs:
+        from_secret: registry_username
-        - DEPLOY_PATH
+      REGISTRY_PASSWORD:
-        - REGISTRY_USERNAME
+        from_secret: registry_password
-        - REGISTRY_PASSWORD
+    commands:
-      script:
+      - apk add --no-cache openssh-client
+      - mkdir -p /root/.ssh && chmod 700 /root/.ssh
+      - printenv SSH_KEY > /root/.ssh/id_ed25519 && chmod 600 /root/.ssh/id_ed25519
       - |
+        ssh -i /root/.ssh/id_ed25519 \
+          -p "${SSH_PORT:-22}" \
+          -o StrictHostKeyChecking=accept-new \
+          -o BatchMode=yes \
+          "${SSH_USER}@${SSH_HOST}" \
+          "export DRONE_COMMIT_SHA='${DRONE_COMMIT_SHA}' REGISTRY_USERNAME='${REGISTRY_USERNAME}' REGISTRY_PASSWORD='${REGISTRY_PASSWORD}'; bash -s" <<'EOS'
         set -euo pipefail
         cd /opt/iled-shop
         git fetch origin
@@ -171,13 +181,7 @@ steps:
         docker compose up -d --remove-orphans
         docker compose ps
         docker logout registry.zea.lt || true
-    environment:
+        EOS
-      DEPLOY_PATH:
-        from_secret: deploy_path
-      REGISTRY_USERNAME:
-        from_secret: registry_username
-      REGISTRY_PASSWORD:
-        from_secret: registry_password
 
 trigger:
   branch: