Fixes the account model deploy setup got wrong

webadmin turned out to be FTP-only and belongs to whoever uploads
customer websites, not to this pipeline. Switched to a separate
deploy account with its own home-directory paths, well away from
where the other sites live, and made the persistent website symlink
cross into webadmin's territory instead of the other way around.

aidlc-docs/features/gitea-deployment-workflow/operations/deployment/deployment-plan.md

@@ -25,6 +25,14 @@ procedure.
 Same physical host for both (per `infrastructure-design.md` § 1) — separated by directory,
 `systemd --user` unit, and local port, never by anything the workflow manages directly.
 
+**Account model (revised at Deployment Setup)**: the Pi's existing `webadmin` account is FileZilla/
+SFTP-only, used by website-workspace authors uploading customer sites under
+`/mnt/storage1/www/html/` (`WEBSITE_WORKSPACE.md`'s role) — it cannot SSH in and stays that way. The
+deploy pipeline uses a **separate, dedicated** SSH-capable account instead
+(`deployment-instructions.md` § 1.2), so the two roles never overlap on one credential. Deploy paths
+live under that account's own home directory, not under `html/` — this was a deliberate choice to
+avoid the CMS's release/current/shared structure interfering with the other websites hosted there.
+
 ## Rationale for What's Documented Here vs. Already Decided
 
 | Already decided (Construction) | Documented here (Operations) |