ci: replace appleboy SSH plugin with OpenSSH

Same fix as iled-shop for reliable Pi deploys.

Co-authored-by: Cursor <cursoragent@cursor.com>

.drone.yml

@@ -106,23 +106,32 @@ concurrency:
 
 steps:
   - name: ssh-deploy
-    image: appleboy/drone-ssh
+    image: alpine:3.20
     pull: false
-    settings:
-      host:
+    environment:
+      SSH_HOST:
         from_secret: ssh_host
-      username:
+      SSH_USER:
         from_secret: ssh_user
-      key:
+      SSH_KEY:
         from_secret: ssh_key
-      port:
+      SSH_PORT:
         from_secret: ssh_port
-      script_stop: true
-      envs:
-        - REGISTRY_USERNAME
-        - REGISTRY_PASSWORD
-      script:
+      REGISTRY_USERNAME:
+        from_secret: registry_username
+      REGISTRY_PASSWORD:
+        from_secret: registry_password
+    commands:
+      - apk add --no-cache openssh-client
+      - mkdir -p /root/.ssh && chmod 700 /root/.ssh
+      - printenv SSH_KEY > /root/.ssh/id_ed25519 && chmod 600 /root/.ssh/id_ed25519
       - |
+        ssh -i /root/.ssh/id_ed25519 \
+          -p "${SSH_PORT:-22}" \
+          -o StrictHostKeyChecking=accept-new \
+          -o BatchMode=yes \
+          "${SSH_USER}@${SSH_HOST}" \
+          "export REGISTRY_USERNAME='${REGISTRY_USERNAME}' REGISTRY_PASSWORD='${REGISTRY_PASSWORD}'; bash -s" <<'EOS'
         set -euo pipefail
         echo "${REGISTRY_PASSWORD}" | docker login registry.zea.lt -u "${REGISTRY_USERNAME}" --password-stdin
         cd /home/miczek/homelab/tracker
@@ -130,11 +139,7 @@ steps:
         docker compose up -d --remove-orphans
         docker compose ps
         docker logout registry.zea.lt || true
-    environment:
-      REGISTRY_USERNAME:
-        from_secret: registry_username
-      REGISTRY_PASSWORD:
-        from_secret: registry_password
+        EOS
 
 trigger:
   branch: