Add CI workflow + baked commit hash

- .gitea/workflows/deploy.yml: test+build on every push; auto-deploy
  dist/index.html to /password_manager via WebDAV on push to main (DELETE-
  then-PUT to bypass stale-file cache), verifying deployed bytes match.
- Build injects __VAULT_COMMIT__ (from VITE_COMMIT_HASH=github.sha in CI,
  git HEAD locally) and main.js logs console.info({ commit_hash }) on
  startup so a deploy is verifiable against its source commit.

.gitea/workflows/deploy.yml

@@ -0,0 +1,97 @@
+name: Test, Build & Deploy
+
+# Tests + build run on every push/PR; the deploy (WebDAV publish of the
+# single-file dist/index.html) runs only on the default branch (main).
+"on":
+  push:
+    branches:
+      - '**'
+  pull_request:
+
+jobs:
+  test-and-build:
+    runs-on: host
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: npm run test:run
+
+      - name: Build (single-file bundle)
+        env:
+          VITE_COMMIT_HASH: ${{ github.sha }}
+        run: npm run build
+
+      - name: Verify build output
+        run: test -f dist/index.html
+
+  deploy:
+    # Release the built app only when a commit lands on the default branch.
+    needs: test-and-build
+    if: github.ref == 'refs/heads/main'
+    runs-on: host
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build (single-file bundle)
+        env:
+          VITE_COMMIT_HASH: ${{ github.sha }}
+        run: npm run build
+
+      - name: Verify build output
+        run: test -f dist/index.html
+
+      # Publish dist/index.html to the WebDAV mirror (/password_manager).
+      # The pretty URL (…/password_manager/index.html) 401s without auth; the
+      # file is the full www/static/password_manager/index.html with basic auth.
+      - name: Publish to WebDAV (/password_manager)
+        env:
+          WEBDAV_USER: ${{ secrets.WEBDAV_USER }}
+          WEBDAV_PASS: ${{ secrets.WEBDAV_PASS }}
+          WEBDAV_URL: https://files.thecookiejar.me/www/static/password_manager/index.html
+        run: |
+          if [ -z "$WEBDAV_USER" ] || [ -z "$WEBDAV_PASS" ]; then
+            echo "::error::WEBDAV_USER / WEBDAV_PASS repo secrets are not set."
+            echo "::error::Add them under Settings -> Actions -> Secrets, then re-run this job."
+            exit 1
+          fi
+          # DELETE-then-PUT: the serving layer caches uploaded files, so a plain
+          # PUT over an existing file returns 201 but keeps serving the OLD copy.
+          # Deleting first guarantees the new build is actually served. (Each curl
+          # is a single line -- YAML block scalars don't convert backslash-nl.)
+          curl -sS -u "$WEBDAV_USER:$WEBDAV_PASS" -X DELETE "$WEBDAV_URL" || echo "(DELETE returned non-zero; file may not exist yet -- continuing)"
+          curl -sS --fail -u "$WEBDAV_USER:$WEBDAV_PASS" -X PUT -T dist/index.html -H 'Content-Type: text/html' "$WEBDAV_URL"
+          echo "Published to $WEBDAV_URL"
+
+      # Pull the freshly uploaded file back and compare it to our build, so a
+      # successful deploy isn't just "curl returned 0" but bytes actually match.
+      - name: Verify deployed file matches build
+        env:
+          WEBDAV_USER: ${{ secrets.WEBDAV_USER }}
+          WEBDAV_PASS: ${{ secrets.WEBDAV_PASS }}
+          WEBDAV_URL: https://files.thecookiejar.me/www/static/password_manager/index.html
+        run: |
+          curl -sS --fail -u "$WEBDAV_USER:$WEBDAV_PASS" "$WEBDAV_URL" -o /tmp/deployed.html
+          sha1sum dist/index.html /tmp/deployed.html
+          test "$(sha1sum dist/index.html | cut -d' ' -f1)" = \
+               "$(sha1sum /tmp/deployed.html | cut -d' ' -f1)" \
+            && echo "Deploy verified: bytes match" \
+            || { echo "::error::Deployed file does not match build"; exit 1; }

dist/index.html

@@ -8091,6 +8091,9 @@ function App($$anchor, $$props) {
 	append($$anchor, fragment_1);
 	pop();
 }
+//#endregion
+//#region src/main.js
+console.info({ commit_hash: "d72f41418cca3982459ec874565f6671a5620dc6" });
 mount(App, { target: document.getElementById("app") });
 //#endregion</script>
     <style rel="stylesheet" crossorigin>/* ===== CSS Reset & Base ===== */

src/main.js

@@ -2,6 +2,9 @@ import { mount } from 'svelte'
 import './styles/main.css'
 import App from './App.svelte'
 
+// Report the baked-in commit hash on startup (handy for verifying a deploy).
+console.info({ commit_hash: __VAULT_COMMIT__ })
+
 const app = mount(App, {
   target: document.getElementById('app'),
 })

vite.config.js

@@ -1,9 +1,25 @@
+import { execSync } from 'node:child_process'
 import { defineConfig } from 'vite'
 import { svelte } from '@sveltejs/vite-plugin-svelte'
 import { viteSingleFile } from 'vite-plugin-singlefile'
 
 // https://vite.dev/config/
+// Bake the commit hash into the bundle at build time so a deployed app can
+// report exactly which commit produced it (logged via console.info at startup).
+// CI sets VITE_COMMIT_HASH=${{ github.sha }}; local builds fall back to git HEAD.
+function getCommitHash() {
+  if (process.env.VITE_COMMIT_HASH) return process.env.VITE_COMMIT_HASH
+  try {
+    return execSync('git rev-parse HEAD').toString().trim()
+  } catch {
+    return 'unknown'
+  }
+}
+
 export default defineConfig(({ command }) => ({
+  define: {
+    __VAULT_COMMIT__: JSON.stringify(getCommitHash()),
+  },
   plugins: [
     svelte(),
     ...(command === 'build'