refactor(justfile): de-dup deploy-code, move nginx/setup to deploy-nginx

TODO.md

@@ -1,8 +1,11 @@
 # TODO
 
-> Last updated: 2026-08-28
+> Last updated: 2026-08-31
 > Context: CSS waste strategy — full stream DEFERRED (tasks 10/u/w/x/y/z): unusedSymbols report showed only ~6.2KB/2.9% of 216KB reclaimable; pruning + per-page split parked (docs/css-split-analysis.md). #t (Interdit admin route) confirmed already implemented via /admin/media.php + media-viewer.php + recapitulatif link. No pending live tasks.
 
+## Pending
+- [x] #justfile-deploy-code-nginx-split [!medium] de-dup deploy-code: it bundled nginx config + server-side setup (full duplicate of deploy-nginx). Now code-only; deploy depends on deploy-nginx; provision-server's duplicate deploy-nginx removed; var/{cache,logs,tmp} mkdir moved into scripts/deploy-server.sh.
+
 ## In Progress
 - [x] #cover-home-lazy-intersect-fix [!high] Fix lazy covers not loading after initial images. Root cause: home grid scrolls inside <main class="home-main"> (overflow-y:auto, body height:100vh flex), but htmx `revealed` listens to window scroll only — so below-fold covers never revealed. Fix: hx-trigger="intersect threshold:0.05 once" (IntersectionObserver works inside any scroll container). VERIFIED LIVE: progressive scroll loads covers 5→11→15→20→22/22 (before: stuck ~5). Committed fix(home): use intersect trigger.
 - [x] #cover-image-webp-avif-serve-lite [!medium] Serve lightweight webp cover thumbnails instead of full-res PNG originals (~99% on worst cases). DONE VERIFIED LIVE 2026-08-31: `cwebp -resize 800 q80` sidecars (+ GD fallback for CMYK JPEGs) generated by ThesisFileHandler at upload (FilePond + legacy); /cover-fragment emits <picture> (webp source + original fallback); backfill scripts/generate-cover-webp.php + `just deploy-cover-webp`. PROD: tools installed (docs), 46/46 covers backfilled (44 cwebp + 2 GD/CMYK), app code deployed, /cover-fragment + /media?path=*.webp verified 200 image/webp 61KB (vs 15.8MB orig). AVIF dropped (no viable prod resize; WEBP sufficient). NOTE: just deploy-code's final nginx/permissions step needs sudo password (operational, pre-existing — not a regression).

justfile

@@ -103,7 +103,7 @@ build-check:
 # ============================================================================
 
 [group('deploy')]
-deploy: build deploy-code deploy-deps deploy-migrate
+deploy: build deploy-code deploy-nginx deploy-deps deploy-migrate
     @just deploy-env
     @just deploy-verify-permissions
     @echo ""
@@ -112,7 +112,8 @@ deploy: build deploy-code deploy-deps deploy-migrate
 
 [group('deploy')]
 deploy-code:
-    # Sync app code + nginx config + permissions (no Composer deps, no migrations)
+    # Sync application code only (no Composer deps, no migrations, no nginx config).
+    # nginx + server-side setup are handled by `deploy-nginx` (via deploy).
     rsync -vur --progress --delete \
         --chown="www-data:xamxam" \
         --exclude '/vendor' \
@@ -145,12 +146,6 @@ deploy-code:
         --exclude 'composer.json' \
         --exclude 'composer.lock' \
         app/ xamxam:/var/www/xamxam/
-    # Deploy nginx config + fix permissions + reload (single server-side run)
-    rsync -v nginx/xamxam.conf xamxam:/tmp/xamxam.conf
-    rsync -v scripts/deploy-server.sh xamxam:/tmp/deploy-server.sh
-    ssh -t xamxam "sudo bash /tmp/deploy-server.sh"
-    ssh xamxam "rm -f /tmp/deploy-server.sh /tmp/xamxam.conf"
-    ssh xamxam "mkdir -p /var/www/xamxam/var/{cache,logs,tmp}"
 
 [group('deploy')]
 deploy-deps:
@@ -509,7 +504,6 @@ deploy-all-first: deploy deploy-backup deploy-cleanup-cron deploy-logrotate
 provision-server:
     @bash scripts/provision-server-env.sh xamxam
     @just deploy
-    @just deploy-nginx
     @just deploy-backup
     @just deploy-cleanup-cron
     @just deploy-logrotate

scripts/deploy-server.sh

@@ -121,6 +121,12 @@ chown www-data:xamxam /var/backups/xamxam
 chmod 2775 /var/backups/xamxam
 ok "Backup dir: /var/backups/xamxam owned by www-data:xamxam (2775)"
 
+# App var/ dirs (cache/logs/tmp) checked by deploy-verify-permissions.
+mkdir -p /var/www/xamxam/var/{cache,logs,tmp}
+chown -R www-data:xamxam /var/www/xamxam/var
+chmod -R 2775 /var/www/xamxam/var
+ok "var/ dirs: /var/www/xamxam/var/{cache,logs,tmp}"
+
 # ── Step 2: Nginx config ──────────────────────────────────────────────────────
 printf "\n📋 Step 2: Deploying nginx configuration...\n"
 echo "--------------------------------------------"