feat(web): add auth and fix deployment checks

tools/deploy_quantengine.sh

@@ -1,8 +1,12 @@
-#!/bin/bash
-# Quant Engine Shadow Copy Hot Deploy Script
-# To be executed on Hz-Prod-01 Remote Server
+#!/usr/bin/env bash
+# Quant Engine CI-only hot deploy script
 
-set -e
+set -euo pipefail
+
+if [ "${CI_DEPLOY:-0}" != "1" ]; then
+    echo "ERROR: CI-only deployment policy. Use the Gitea workflow to deploy."
+    exit 1
+fi
 
 DEPLOY_BASE="/home/kjh2064/deployments"
 ACTIVE_LINK="/home/kjh2064/quantengine_active"
@@ -15,11 +19,9 @@ echo "========================================="
 echo "Starting Shadow Copy Hot Deploy [${TIMESTAMP}]"
 echo "========================================="
 
-# 1. Ensure directories exist
 mkdir -p "${DEPLOY_BASE}"
 mkdir -p "${TARGET_DIR}"
 
-# 2. Extract build artifact to unique shadow directory
 if [ -f "${TMP_ARCHIVE}" ]; then
     echo "Extracting build artifact to ${TARGET_DIR}..."
     tar -xzf "${TMP_ARCHIVE}" -C "${TARGET_DIR}"
@@ -29,15 +31,12 @@ else
     exit 1
 fi
 
-# 3. Swap symbolic link atomically
 echo "Swapping symbolic link dynamically..."
 ln -sfn "${TARGET_DIR}" "${ACTIVE_LINK}"
 
-# 4. Restart Systemd service (requires passwordless sudo reload or specific policy)
 echo "Restarting Systemd service..."
 sudo systemctl restart quantengine
 
-# 5. Clean up old deployments (keep last 5)
 echo "Cleaning up obsolete deployments..."
 cd "${DEPLOY_BASE}"
 ls -dt quantengine_* | tail -n +6 | while read -r old_dir; do