ci(deploy): use pnpm directly and run deploy jobs on the infra runner

Run #2 exposed two runner-mismatch bugs (now documented in architecture
gitea-runners.md):

- build-web failed with `corepack: command not found` — the fedora runners
  ship pnpm preinstalled via npm, not corepack. Call pnpm directly.
- deploy jobs need an ssh client, which the base fedora images lack (they have
  rsync but not openssh-clients). Move deploy-api/deploy-web to `runs-on: infra`.

build-api already passes on `runs-on: rust`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP

.gitea/workflows/deploy.yml

@@ -7,11 +7,11 @@
 #   api + worker  -> slartibartfast.kosherinata.internal  (share one SQLite file)
 #   web (SPA)     -> oolon.kosherinata.internal           (nginx serves + proxies /v1)
 #
-# Runners (labels match the fleet's registered runners): Rust jobs run on `rust`
-# (cargo toolchain); node/deploy jobs run on `fedora-43` (node + rsync/ssh/curl).
-# The whole fleet is Fedora 43, so binaries are built native — no glibc skew, no musl
-# toolchain needed (deployment-gitea-actions.md §6: build on a runner no newer than the
-# oldest target).
+# Runners (see architecture gitea-runners.md): Rust build on `rust` (cargo toolchain);
+# SPA build on `fedora-43` (node + pnpm); deploy jobs on `infra` (the only general image
+# with an ssh client + rsync). The whole fleet is Fedora, so binaries are built native —
+# no glibc skew, no musl toolchain needed (deployment-gitea-actions.md §6: build on a
+# runner no newer than the oldest target).
 #
 # One-time host prep (gitea_ci user, sudoers, service account, dirs, cert, vhost) is done
 # by script/infra-setup.sh. Only secret required here: RSYNC_SSH_KEY (the runner's private
@@ -58,8 +58,9 @@ jobs:
       - uses: actions/checkout@v4
       - name: build SPA
         working-directory: web
+        # pnpm is preinstalled globally on the fedora runners (via npm i -g pnpm);
+        # Fedora's nodejs doesn't bundle corepack, so call pnpm directly.
         run: |
-          corepack enable
           pnpm install --frozen-lockfile
           pnpm build
       - uses: actions/upload-artifact@v3
@@ -69,7 +70,7 @@ jobs:
 
   deploy-api:
     needs: build-api
-    runs-on: fedora-43
+    runs-on: infra
     steps:
       - uses: actions/checkout@v4
       - uses: actions/download-artifact@v3
@@ -127,7 +128,7 @@ jobs:
 
   deploy-web:
     needs: build-web
-    runs-on: fedora-43
+    runs-on: infra
     steps:
       - uses: actions/download-artifact@v3
         with: