deploy: exclude storage/{tmp,documents,theses,triage,backups,logs} from rsync + fix .env perm check to 640

TODO.md

@@ -1,5 +1,9 @@
 # Current tasks
 
+## Deploy exclusions
+- [x] Exclude storage/tmp/ (not just filepond/*) to skip _trash dirs with bad perms
+- [x] Exclude storage/documents/ and storage/theses/ from rsync deploy
+
 ## Commit history cleanup
 - [x] Squash 177→98 commits by merging similar/iterative fixes and immediate follow-ups
 - [x] Resolve 206k lines of nested jj conflict markers in acces.php

justfile

@@ -58,7 +58,12 @@ deploy:
         --exclude 'storage/maintenance.flag' \
         --exclude 'storage/fixtures' \
         --exclude 'storage/docs' \
-        --exclude 'storage/tmp/filepond/*' \
+        --exclude 'storage/tmp/' \
+        --exclude 'storage/documents/' \
+        --exclude 'storage/theses/' \
+        --exclude 'storage/triage/' \
+        --exclude 'storage/backups/' \
+        --exclude 'storage/logs/' \
         --exclude 'var/' \
         app/ xamxam:/var/www/xamxam/
     # Deploy nginx config + fix permissions + reload (single server-side run)
@@ -177,7 +182,7 @@ deploy-verify-permissions:
     owner=$(echo "$perms" | awk '{print $2}')
     group=$(echo "$perms" | awk '{print $3}')
     case "$path" in
-    */storage/xamxam.db|*/storage/*.db)
+    */storage/xamxam.db|*/storage/*.db|*/*/.env)
     expected_perm="660" ;;
     *)
     expected_perm="664" ;;