Deploy Prod with its own SSH key

prod-deploy.yml reused the test-stage deploy key since go-live (the
checklist's optional-hygiene item). A third keypair now completes the
one-key-per-stage picture: DEPLOY_SSH_KEY_PROD secret, pubkey
dorfteich-deploy-prod in the deploy user's authorized_keys. This
separates rotation and audit per stage — not privileges: every key
lands in the same docker-group deploy user on the single host.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/prod-deploy.yml

@@ -38,7 +38,7 @@ jobs:
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY_TEST }}" > ~/.ssh/id_ed25519
+          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY_PROD }}" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
           printf '%s\n' "${{ secrets.DEPLOY_HOST_KEY }}" > ~/.ssh/known_hosts
 

deploy/go-live.md

@@ -70,6 +70,9 @@ the DNS switch.
       provisioned (`deploy/backup-basel.md`), mirror live on Test AND on
       Prod since the v0.2.0 deploy (first run verified: all sets on
       BASEL, `status.json → mirror.lastRun = succeeded`).
-- [ ] Optional hygiene: a dedicated `DEPLOY_SSH_KEY_PROD` secret (the
-      workflows currently reuse the host-wide deploy key stored as
-      `DEPLOY_SSH_KEY_TEST`).
+- [x] Optional hygiene: a dedicated `DEPLOY_SSH_KEY_PROD` secret
+      (done 2026-07-14: third keypair `dorfteich-deploy-prod` in the
+      deploy user's authorized_keys, prod-deploy.yml switched off the
+      test key; every stage now deploys with its own revocable key —
+      note this separates rotation and audit, not privileges, since all
+      keys land in the same docker-group deploy user).