ci(staging): build env from Gitea secrets; drop redundant host build

The host-mode runner does a clean checkout without the git-ignored
deploy/.env.staging, so regenerate it from Actions secrets
(STAGING_POSTGRES_PASSWORD / STAGING_GOOGLE_CLIENT_ID / STAGING_GOOGLE_CLIENT_SECRET)
at deploy time. Drop the duplicate host build+test — 'docker compose --build'
compiles the API image in-container and CI already gates tests on the PR.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy-staging.yml

@@ -1,15 +1,14 @@
 name: Deploy Staging
 
 # Continuous deployment to the LOCAL staging stack. Fires when develop advances
-# (i.e. after a PR is merged into develop). It re-verifies the code, then rebuilds
+# (i.e. after a PR is merged into develop), rebuilding and restarting the isolated
-# and restarts the isolated staging stack on this machine.
+# staging stack on this machine.
 #
-# CRITICAL: staging lives on your Windows box (ports 18080/18081). A cloud or
+# Runs on the self-hosted host-mode runner (labels: self-hosted, windows) so it can
-# container runner CANNOT reach it, so this job MUST run on a self-hosted Gitea
+# reach the host's Docker and publish to localhost:18081. Because the runner does a
-# Actions runner registered ON that Windows machine with Docker access
+# fresh checkout that (correctly) does NOT contain the git-ignored deploy/.env.staging,
-# (labels: self-hosted, windows). Until that runner exists this job just waits
+# the staging secrets are supplied as Gitea Actions secrets and the env file is
-# in the queue (harmless, cancelable) — deploy staging manually meanwhile with:
+# regenerated here at deploy time.
-#   ./deploy/up.ps1 -Staging
 on:
   push:
     branches: [develop]
@@ -21,12 +20,20 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # Re-run the gate on the exact merged code before it touches staging.
+      - name: Write staging env from secrets
-      - name: Build + test (Release)
         shell: powershell
+        # Single-quoted here-string: Gitea substitutes the ${{ secrets.* }} tokens
+        # before the shell runs, and PowerShell then treats the values literally
+        # (no $ interpolation). ascii = no BOM, which docker compose's env parser needs.
         run: |
-          dotnet build InboxIntel.sln -c Release --nologo
+          @'
-          dotnet test  InboxIntel.sln -c Release --no-build --nologo
+          POSTGRES_PASSWORD=${{ secrets.STAGING_POSTGRES_PASSWORD }}
+          GOOGLE_CLIENT_ID=${{ secrets.STAGING_GOOGLE_CLIENT_ID }}
+          GOOGLE_CLIENT_SECRET=${{ secrets.STAGING_GOOGLE_CLIENT_SECRET }}
+          AI_MODE=Disabled
+          FRONTEND_ORIGIN=http://localhost:18081
+          MAX_MESSAGES=2000
+          '@ | Out-File -FilePath deploy/.env.staging -Encoding ascii
 
       - name: Redeploy staging stack
         shell: powershell