Switch deploy pipeline to Gitea polling; fix env-parsing and volume-isolation bugs

- Replace the bare-repo post-receive hook with deploy/poll-deploy.sh: Gitea
  and the Docker hosts are separate machines, so each box polls its branch
  via host crontab instead of needing an exposed webhook receiver.
- Add Blocksy theme + Blocksy Companion auto-install to deploy.sh (free
  tier; the paid Book Store starter site still needs a manual license step).
- Fix deploy.sh/backup.sh/restore.sh sourcing .env files as bash: a bcrypt
  hash's `$2a$14$...` shape breaks under `set -u`. Replaced with
  deploy/lib/env.sh, a literal (non-executing) KEY=VALUE reader.
- Fix docker compose itself mangling the same kind of value: both
  `environment: ${VAR}` and `env_file:` run values through Compose's
  interpolation, which silently blanks `$identifier`-shaped substrings.
  The staging basic-auth hash is now rendered directly into the Caddyfile
  by deploy.sh, bypassing Compose's variable system entirely.
- Fix dev/staging/production silently sharing one Compose project (and
  therefore one db_data volume) by pinning an explicit -p per environment.
- cron and wordpress now share one environment anchor so they can't drift
  apart again (cron was silently missing WORDPRESS_CONFIG_EXTRA before).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/deploy.sh

@@ -18,12 +18,32 @@ if [[ ! -f "$ENV_FILE" ]]; then
   echo "missing $ENV_FILE — copy .env.example to $ENV_FILE and fill it in" >&2
   exit 1
 fi
-set -a
-# shellcheck disable=SC1090
-source "$ENV_FILE"
-set +a
+# shellcheck source=lib/env.sh
+source "$REPO_ROOT/deploy/lib/env.sh"
 
-COMPOSE="docker compose -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${ENV_FILE}"
+SITE_URL="$(env_get "$ENV_FILE" SITE_URL)"
+SITE_TITLE="$(env_get "$ENV_FILE" SITE_TITLE)"
+WP_ADMIN_USER="$(env_get "$ENV_FILE" WP_ADMIN_USER)"
+WP_ADMIN_PASSWORD="$(env_get "$ENV_FILE" WP_ADMIN_PASSWORD)"
+WP_ADMIN_EMAIL="$(env_get "$ENV_FILE" WP_ADMIN_EMAIL)"
+
+# -p pins the Compose project name to the environment (default is the
+# directory name, which every environment shares — that made staging quietly
+# reuse dev's db_data volume/credentials the first time this ran).
+COMPOSE="docker compose -p bookstore-${ENVIRONMENT} -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${ENV_FILE}"
+
+if [[ "$ENVIRONMENT" == "staging" ]]; then
+  echo "==> rendering Caddyfile.staging (basic-auth hash bypasses compose entirely)"
+  mkdir -p docker/caddy/.generated
+  AUTH_USER="$(env_get "$ENV_FILE" STAGING_BASIC_AUTH_USER)"
+  AUTH_HASH="$(env_get "$ENV_FILE" STAGING_BASIC_AUTH_HASH)"
+  : "${AUTH_USER:?set STAGING_BASIC_AUTH_USER in ${ENV_FILE}}"
+  : "${AUTH_HASH:?set STAGING_BASIC_AUTH_HASH in ${ENV_FILE} — see .env.example for how to generate it}"
+  TEMPLATE="$(cat docker/caddy/Caddyfile.staging)"
+  TEMPLATE="${TEMPLATE//__STAGING_BASIC_AUTH_USER__/$AUTH_USER}"
+  TEMPLATE="${TEMPLATE//__STAGING_BASIC_AUTH_HASH__/$AUTH_HASH}"
+  printf '%s\n' "$TEMPLATE" > docker/caddy/.generated/Caddyfile.staging
+fi
 
 echo "==> building and starting ${ENVIRONMENT}"
 $COMPOSE up -d --build