ci: use unbraced $$SECRET escapes in deploy ssh

.drone.yml

@@ -125,17 +125,16 @@ steps:
       - apk add --no-cache openssh-client
       - mkdir -p /root/.ssh && chmod 700 /root/.ssh
       - printenv SSH_KEY > /root/.ssh/id_ed25519 && chmod 600 /root/.ssh/id_ed25519
-      # Drone pre-expands ${VAR} (empty for secrets). Use $VAR / $$ so the shell
-      # reads the from_secret environment at runtime.
+      # Escape secrets as $$… so Drone does not pre-expand them to empty.
       - |
         ssh -i /root/.ssh/id_ed25519 \
-          -p "$${SSH_PORT:-22}" \
+          -p "$$SSH_PORT" \
           -o StrictHostKeyChecking=accept-new \
           -o BatchMode=yes \
-          "$${SSH_USER}@$${SSH_HOST}" \
-          "export REGISTRY_USERNAME='$${REGISTRY_USERNAME}' REGISTRY_PASSWORD='$${REGISTRY_PASSWORD}'; bash -s" <<'EOS'
+          "$$SSH_USER@$$SSH_HOST" \
+          "export REGISTRY_USERNAME='$$REGISTRY_USERNAME' REGISTRY_PASSWORD='$$REGISTRY_PASSWORD'; bash -s" <<'EOS'
         set -euo pipefail
-        echo "$${REGISTRY_PASSWORD}" | docker login registry.zea.lt -u "$${REGISTRY_USERNAME}" --password-stdin
+        echo "$$REGISTRY_PASSWORD" | docker login registry.zea.lt -u "$$REGISTRY_USERNAME" --password-stdin
         cd /home/miczek/homelab/tracker
         docker compose pull
         docker compose up -d --remove-orphans