ci: replace appleboy SSH plugin with OpenSSH

appleboy/drone-ssh failed with a local git error when clone is
disabled; alpine + ssh is reliable for Pi deploys.

Co-authored-by: Cursor <cursoragent@cursor.com>

.drone.yml

@@ -142,42 +142,46 @@ concurrency:
   limit: 1
 
 steps:
+  # appleboy/drone-ssh misbehaves with clone:disable (local git error).
+  # Plain OpenSSH from alpine is reliable.
   - name: ssh-deploy
-    image: appleboy/drone-ssh
+    image: alpine:3.20
     pull: false
-    settings:
-      host:
-        from_secret: ssh_host
-      username:
-        from_secret: ssh_user
-      key:
-        from_secret: ssh_key
-      port:
-        from_secret: ssh_port
-      script_stop: true
-      envs:
-        - DEPLOY_PATH
-        - REGISTRY_USERNAME
-        - REGISTRY_PASSWORD
-      script:
-        - |
-          set -euo pipefail
-          cd /opt/iled-shop
-          git fetch origin
-          git checkout "${DRONE_COMMIT_SHA}"
-          echo "${REGISTRY_PASSWORD}" | docker login registry.zea.lt -u "${REGISTRY_USERNAME}" --password-stdin
-          cd docker
-          docker compose pull
-          docker compose up -d --remove-orphans
-          docker compose ps
-          docker logout registry.zea.lt || true
     environment:
-      DEPLOY_PATH:
+      SSH_HOST:
-        from_secret: deploy_path
+        from_secret: ssh_host
+      SSH_USER:
+        from_secret: ssh_user
+      SSH_KEY:
+        from_secret: ssh_key
+      SSH_PORT:
+        from_secret: ssh_port
       REGISTRY_USERNAME:
         from_secret: registry_username
       REGISTRY_PASSWORD:
         from_secret: registry_password
+    commands:
+      - apk add --no-cache openssh-client
+      - mkdir -p /root/.ssh && chmod 700 /root/.ssh
+      - printenv SSH_KEY > /root/.ssh/id_ed25519 && chmod 600 /root/.ssh/id_ed25519
+      - |
+        ssh -i /root/.ssh/id_ed25519 \
+          -p "${SSH_PORT:-22}" \
+          -o StrictHostKeyChecking=accept-new \
+          -o BatchMode=yes \
+          "${SSH_USER}@${SSH_HOST}" \
+          "export DRONE_COMMIT_SHA='${DRONE_COMMIT_SHA}' REGISTRY_USERNAME='${REGISTRY_USERNAME}' REGISTRY_PASSWORD='${REGISTRY_PASSWORD}'; bash -s" <<'EOS'
+        set -euo pipefail
+        cd /opt/iled-shop
+        git fetch origin
+        git checkout "${DRONE_COMMIT_SHA}"
+        echo "${REGISTRY_PASSWORD}" | docker login registry.zea.lt -u "${REGISTRY_USERNAME}" --password-stdin
+        cd docker
+        docker compose pull
+        docker compose up -d --remove-orphans
+        docker compose ps
+        docker logout registry.zea.lt || true
+        EOS
 
 trigger:
   branch: