deploy: git pull on VPS before reload, sync cards/ down

Drag-drop on the live board was 404-ing for cards added from a
developer's local repo. Root cause: the running app's git-sync
layer pushes API mutations but doesn't pull, so cards landing in
main from any path other than the API never reach the VPS disk.
The UI renders them anyway because content collections are
bundled into dist/ at build time, which IS in sync with main.
The mismatch produces a 404 on every move/edit of those cards.

Fix: git fetch && git pull --rebase --autostash inside the deploy
workflow, between rsync and pm2 reload. Catches the VPS's cards/
up to main on every deploy. --autostash defends the debounced-
commit window in the unlikely case it fires during the pull.

Long-term fix would be to have the running app pull on a timer
(or on startup), so VPS state never drifts beyond a deploy
cadence. Worth doing in a follow-up but the deploy-time pull
covers the main pain point.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: AdaInTheLab

.github/workflows/deploy.yml

@@ -75,6 +75,24 @@ jobs:
           echo "${{ secrets.DH_SSH_KEY }}" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
 
+      - name: Pull latest cards into VPS working tree
+        # The running app's git-sync layer commits + pushes API mutations
+        # to origin, but never pulls. So a card created from a developer's
+        # local machine (or any commit landing on main outside the API
+        # path) never reaches the VPS disk ~ and any attempt to mutate it
+        # via the API 404s with "No card with id ..." even though the UI
+        # renders it (the UI shows cards bundled into dist/ at build time,
+        # which is in sync with main).
+        #
+        # Catch the VPS up before reloading. --autostash protects any
+        # uncommitted change the debounced commit hasn't gotten to yet
+        # (extremely unlikely in the deploy window, but cheap to be
+        # defensive about).
+        run: |
+          ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=yes \
+            "$DH_USER@$DH_HOST" \
+            "cd $DH_PATH && git fetch origin main && git pull --rebase --autostash origin main"
+
       - name: Rsync dist/ + ecosystem cjs to VPS
         run: |
           # Use --delete on dist/ so stale chunks get cleaned up between deploys.