Use a restricted HestiaCP deployment account in CI

[coderabbitai]

Summary

Provision a restricted HestiaCP deployment account and update the CI deployment workflow to use it.

Rationale

.github/workflows/ci.yml currently runs the deploy-hestiacp rsync transfers as root with VPS_SSH_KEY. A compromised CI job or deployment credential could provide root-level access that is not required to deploy static files.

Required changes

1. Create a dedicated HestiaCP deployment account on the server.
2. Configure its SSH key for deployment access.
3. Restrict the account and key so they can access only the required HestiaCP public_html deployment path.
4. Store the deployment account name and scoped SSH key as repository secrets, for example VPS_DEPLOY_USER and a dedicated deploy-key secret.
5. Update the deploy-hestiacp job in .github/workflows/ci.yml to replace remote_user: root and secrets.VPS_SSH_KEY with the restricted account and its dedicated key.
6. Preserve the existing remote_host and HestiaCP remote_path configuration.

Affected area

• .github/workflows/ci.yml — deploy-hestiacp

Acceptance criteria

• The HestiaCP deployment job does not authenticate as root.
• The workflow uses a dedicated deployment account and a dedicated SSH key.
• The deployment account/key cannot access paths outside the required deployment scope.
• The job still deploys dist/ and deploy/.htaccess to the existing HestiaCP public_html path.
• A deployment from main completes successfully after the new credentials are configured.

Backlinks

• Pull request: ci: gate deploys on CI, add flaky-test quarantine, prepare merge queue #398
• Review comment: ci: gate deploys on CI, add flaky-test quarantine, prepare merge queue #398 (comment)

Requested by: @NesiciCoding