fix: Reference the actual registered SSH secret name

Found via SSH log analysis (Run #2003, task 2334): the "Verify SSH
Key and Secrets" step failed immediately with
"DEPLOY_SSH_KEY_B64 or DEPLOY_SSH_KEY not configured" -- both were
empty. Queried GET /repos/{repo}/actions/secrets directly and found
the actually-registered secrets are named SSH_PRIVATE_KEY and
QUANTENGINE_DB_PASSWORD; DEPLOY_SSH_KEY_B64/DEPLOY_SSH_KEY were never
created, despite CLAUDE.md claiming "SSH credentials: SSH_KEY
registered in Gitea Secrets".

Every past deploy-prod.yml run that reached the SSH step (e.g. Run
#1991's Pre-Deployment Verification) failed here for the same reason
-- this was never a working path, just never diagnosed down to the
secret name before now.

Fix: check secrets.SSH_PRIVATE_KEY first (with the same PEM-vs-base64
auto-detection used for the legacy names), falling back to
DEPLOY_SSH_KEY_B64 / DEPLOY_SSH_KEY in case those get added later.
Applied to all three places that build ~/.ssh/deploy_key (deploy job
verify + setup, and post-deploy-check's setup).

.gitea/workflows/deploy-prod.yml

@@ -32,10 +32,15 @@ jobs:
     steps:
       - name: Verify SSH Key and Secrets
         run: |
+          # SSH_PRIVATE_KEY is the actual secret name registered in this repo
+          # (verified via GET /repos/{r}/actions/secrets -- DEPLOY_SSH_KEY_B64 /
+          # DEPLOY_SSH_KEY were never actually created despite CLAUDE.md
+          # claiming so; kept as fallback names in case they're added later).
+          SSH_KEY="${{ secrets.SSH_PRIVATE_KEY }}"
           SSH_KEY_B64="${{ secrets.DEPLOY_SSH_KEY_B64 }}"
           SSH_KEY_RAW="${{ secrets.DEPLOY_SSH_KEY }}"
-          if [ -z "$SSH_KEY_B64" ] && [ -z "$SSH_KEY_RAW" ]; then
+          if [ -z "$SSH_KEY" ] && [ -z "$SSH_KEY_B64" ] && [ -z "$SSH_KEY_RAW" ]; then
-            echo "ERROR: DEPLOY_SSH_KEY_B64 or DEPLOY_SSH_KEY not configured"
+            echo "ERROR: No SSH key secret configured (checked SSH_PRIVATE_KEY, DEPLOY_SSH_KEY_B64, DEPLOY_SSH_KEY)"
             exit 1
           fi
           [ -z "${{ secrets.GITEA_TOKEN }}" ] && { echo "ERROR: GITEA_TOKEN not configured"; exit 1; }
@@ -104,17 +109,25 @@ jobs:
       - name: Setup SSH
         run: |
           mkdir -p ~/.ssh
+          SSH_KEY="${{ secrets.SSH_PRIVATE_KEY }}"
           SSH_KEY_B64="${{ secrets.DEPLOY_SSH_KEY_B64 }}"
           SSH_KEY_RAW="${{ secrets.DEPLOY_SSH_KEY }}"
 
-          if [ -n "$SSH_KEY_B64" ]; then
+          write_key() {
+            # $1 = raw secret value; auto-detects PEM vs base64
+            if printf '%s' "$1" | grep -q 'BEGIN.*PRIVATE KEY'; then
+              printf '%b\n' "$1" > ~/.ssh/deploy_key
+            else
+              printf '%s' "$1" | base64 -d > ~/.ssh/deploy_key
+            fi
+          }
+
+          if [ -n "$SSH_KEY" ]; then
+            write_key "$SSH_KEY"
+          elif [ -n "$SSH_KEY_B64" ]; then
             printf '%s' "$SSH_KEY_B64" | base64 -d > ~/.ssh/deploy_key
           elif [ -n "$SSH_KEY_RAW" ]; then
-            if printf '%s' "$SSH_KEY_RAW" | grep -q 'BEGIN.*PRIVATE KEY'; then
+            write_key "$SSH_KEY_RAW"
-              printf '%b\n' "$SSH_KEY_RAW" > ~/.ssh/deploy_key
-            else
-              printf '%s' "$SSH_KEY_RAW" | base64 -d > ~/.ssh/deploy_key
-            fi
           else
             echo "ERROR: No SSH key configured"
             exit 1
@@ -207,10 +220,17 @@ jobs:
       - name: Setup SSH (for service check)
         run: |
           mkdir -p ~/.ssh
+          SSH_KEY="${{ secrets.SSH_PRIVATE_KEY }}"
           SSH_KEY_B64="${{ secrets.DEPLOY_SSH_KEY_B64 }}"
           SSH_KEY_RAW="${{ secrets.DEPLOY_SSH_KEY }}"
 
-          if [ -n "$SSH_KEY_B64" ]; then
+          if [ -n "$SSH_KEY" ]; then
+            if printf '%s' "$SSH_KEY" | grep -q 'BEGIN.*PRIVATE KEY'; then
+              printf '%b\n' "$SSH_KEY" > ~/.ssh/deploy_key
+            else
+              printf '%s' "$SSH_KEY" | base64 -d > ~/.ssh/deploy_key
+            fi
+          elif [ -n "$SSH_KEY_B64" ]; then
             printf '%s' "$SSH_KEY_B64" | base64 -d > ~/.ssh/deploy_key
           elif [ -n "$SSH_KEY_RAW" ]; then
             printf '%s' "$SSH_KEY_RAW" | base64 -d > ~/.ssh/deploy_key