Add deploy script with dry-run, retry, rollback and health checks

AGENTS.md

@@ -19,6 +19,9 @@ make build-all
 
 # Tests
 go test ./...
+
+# Deploy (full build + bump + push + LXC deploy + verify)
+./scripts/deploy.sh
 ```
 
 ## Version Bumping
@@ -46,6 +49,42 @@ ssh root@10.5.1.30 '/usr/bin/syncserver --version'
 ssh root@10.5.1.30 'journalctl -u syncserver -n 3 --no-pager'
 ```
 
+
+## Deploy Flow
+
+The `make deploy` target (or `./scripts/deploy.sh`) automates the full deployment pipeline:
+
+1. **Pre-flight** — checks git clean, on main branch, LXC reachable, disk space
+2. **Version bump** — runs `bump-version.sh`, commits and pushes automatically
+3. **Build** — `make clean && make package` (Linux amd64 .deb)
+4. **Backup** — copies current `/usr/bin/syncserver` to `/var/backups/syncserver.previous.<version>`
+5. **Deploy** — scp .deb to LXC, run `dpkg -i`
+6. **Verify** — service active, version matches, Cache-Control headers correct, HTTP 200
+
+### Deploy Options
+
+```bash
+./scripts/deploy.sh                    # Full deploy
+./scripts/deploy.sh --dry-run          # Simulate without making changes
+SKIP_BUILD=1 ./scripts/deploy.sh       # Use existing .deb
+SKIP_VERIFY=1 ./scripts/deploy.sh     # Skip post-deploy checks
+LXC_HOST=root@10.5.1.30 ./scripts/deploy.sh  # Custom target
+```
+
+### Rollback
+
+If verification fails after deploy, the script automatically rolls back to the backup binary. Manual rollback:
+
+```bash
+ssh root@10.5.1.30 "cp /var/backups/syncserver.previous.<version> /usr/bin/syncserver && systemctl restart syncserver"
+```
+
+### LXC Host
+
+- **Host**: `root@10.5.1.30`
+- **Remote dir**: `~/move-data-nas`
+- **Service**: `syncserver` (systemd)
+
 ## Critical Build Order
 
 1. Frontend must be built FIRST: `cd web && npm run build`