deploy: Docker compose + entrypoint (pull-loop autosync), Nix revert script, .env (gitignored) for Gitea deploy token

deploy/deploy-apply.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Apply Kontra Nix additions on .13 and rebuild. Run as: sudo bash deploy-apply.sh --from /var/www/kontra_day/deploy
+set -euo pipefail
+
+DEPLOY_DIR="${1:-/var/www/kontra_day/deploy}"
+CFG=/etc/nixos/configuration.nix
+BAK=$CFG.bak-kontra-$(date +%Y%m%d-%H%M%S)
+
+echo "== backup configuration.nix -> $BAK"
+cp -a "$CFG" "$BAK"
+
+echo "== patch configuration.nix"
+python3 "$DEPLOY_DIR/patch-nix.py" "$CFG"
+
+echo "== Nix syntax check"
+if ! nix-instantiate --parse "$CFG" >/dev/null; then
+  echo "!! Nix syntax FAILED — restoring backup"
+  cp -a "$BAK" "$CFG"
+  exit 1
+fi
+echo "OK"
+
+echo "== nixos-rebuild switch (may take minutes)"
+nixos-rebuild switch --show-trace 2>&1 | tail -40
+
+echo "== status"
+systemctl --no-pager --full status kontra.service 2>/dev/null | head -12
+systemctl --no-pager list-timers kontra-pull.timer 2>/dev/null | head -4
+echo "ALL DONE"