Fix: split deploy recipe into deploy-code/deploy-deps/deploy-migrate; deploy-deps always syncs composer.json+composer.lock, runs composer install only when lockfile checksum changed

justfile

@@ -37,8 +37,16 @@ logs:
 # ============================================================================
 
 [group('deploy')]
-deploy:
-    # Main deploy (code + assets) then run any pending DB migrations
+deploy: deploy-code deploy-deps deploy-migrate
+    @just deploy-env
+    @just deploy-verify-permissions
+    @echo ""
+    @echo "ℹ️  First deploy? Also run: just deploy-backup"
+    @echo ""
+
+[group('deploy')]
+deploy-code:
+    # Sync app code + nginx config + permissions (no Composer deps, no migrations)
     rsync -vur --progress --delete \
         --chown="www-data:xamxam" \
         --exclude '/vendor' \
@@ -75,19 +83,28 @@ deploy:
     ssh -t xamxam "sudo bash /tmp/deploy-server.sh"
     ssh xamxam "rm -f /tmp/deploy-server.sh /tmp/xamxam.conf"
     ssh xamxam "mkdir -p /var/www/xamxam/var/{cache,logs,tmp}"
-    # Install/update Composer dependencies (vendor/ excluded from rsync above)
+
+[group('deploy')]
+deploy-deps:
+    # Sync composer.json + composer.lock to server, then run composer install
+    # (only if composer.lock checksum changed — skip expensive install otherwise)
     rsync -v composer.json composer.lock xamxam:/var/www/xamxam/
-    ssh xamxam "cd /var/www/xamxam && composer install --no-dev --no-interaction --optimize-autoloader"
-    # Run pending migrations (creates DB from schema if missing, idempotent)
+    ssh xamxam 'cd /var/www/xamxam && \
+        if [ ! -f vendor/.composer-lock-checksum ] || \
+           [ "$(sha256sum composer.lock | cut -d" " -f1)" != "$(cat vendor/.composer-lock-checksum)" ]; then \
+            echo "→ composer.lock changed, installing dependencies…"; \
+            composer install --no-dev --no-interaction --optimize-autoloader && \
+            sha256sum composer.lock | cut -d" " -f1 > vendor/.composer-lock-checksum; \
+        else \
+            echo "→ composer.lock unchanged, skipping composer install"; \
+        fi'
+
+[group('deploy')]
+deploy-migrate:
+    # Run pending DB migrations (creates DB from schema if missing, idempotent)
     rsync -v scripts/migrate.sh xamxam:/tmp/migrate.sh
     ssh xamxam "cd /var/www/xamxam && REPO_ROOT=/var/www/xamxam bash /tmp/migrate.sh"
     ssh xamxam "rm -f /tmp/migrate.sh"
-    # Sync .env separately (excluded above to avoid accidental overwrite on subsequent deploys)
-    @just deploy-env
-    @just deploy-verify-permissions
-    @echo ""
-    @echo "ℹ️  First deploy? Also run: just deploy-backup"
-    @echo ""
 
 [group('deploy')]
 deploy-env: