Fix CI deploy: sync composer.lock and add hosting config.

phpseclib was missing from the lock file, which caused composer install
to fail on the Gitea deploy runner.

Co-authored-by: Cursor <cursoragent@cursor.com>

DEPLOY.md

@@ -26,11 +26,13 @@ Mirrors the Ladill Domains / Email deployment model (app-slot + own DB + Gitea C
 
 ## 1. Gitea repo + CI
 
-1. Create repo `isaacclad/ladill-hosting` in Gitea.
-2. Push this repo (`git remote add origin … && git push -u origin main`).
-3. Ensure an instance-level Actions runner exists (shared with Bird/Domains/Email).
-4. CI secrets (`.gitea/workflows/deploy.yml`): `SSH_HOST`, `SSH_PORT`, `SSH_USER`,
-   `APP_ROOT` = `/var/www/ladill-hosting`, deploy SSH key.
+1. Repo: **http://161.97.138.149:3000/isaacclad/ladill-hosting**
+2. Push to `main` triggers `.gitea/workflows/deploy.yml` on the **deploy** runner
+   (`ladill-deploy-runner.service` on the VPS — same as Bird/Domains/Email).
+3. Pipeline: clone → `npm ci && npm run build` → release tarball →
+   `deploy/deploy.sh` → `/var/www/ladill-hosting/current`.
+4. No SSH secrets required — the runner executes on-host as `deploy`.
+5. Manual deploy: Gitea → Actions → **Deploy Ladill Hosting** → Run workflow.
 
 ## 2. Server app-slot + database