Adds Monitoring Setup docs and deploy-scp troubleshooting/debug fixes

Monitoring Setup: operations/plans/monitoring-setup-plan.md and
operations/monitoring/monitoring-instructions.md, covering Sentry alert
rules on the security_event tag, UptimeRobot's 6 liveness monitors, and
the two new Umami website entries for the admin SPA.

deployment-instructions.md gains a missing Observability__Environment
host var (without it, both environments would tag Sentry events as
"Production"), the nginx client_max_body_size fix for the 413 seen on
publish-test/production artifact uploads, and two troubleshooting notes
on Gitea Actions re-run behaviour: re-running deploy-test/production
alone loses the run's uploaded artifact, and re-running all jobs on an
existing (rather than a brand new) run can replay stale secrets.

deploy-scp.yaml: step names no longer show literal unresolved
${{ inputs.* }} text (Gitea doesn't interpolate that context in step
names), and a temporary debug step logs PI_MAIN_USERNAME/PASSWORD
length plus a username equality check to diagnose a persistent
Permission denied during the SSH steps, without ever logging the
secret values themselves.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015FffvxxJp5wG34Ru48GBig

.gitea/workflows/deploy-scp.yaml

@@ -42,6 +42,19 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
+      # TEMPORARY — diagnosing a persistent "Permission denied, please try again." (sshpass exit 5)
+      # on the SSH steps below. Never prints the actual secret values, only lengths and a boolean
+      # match against the expected username, so it's safe to leave in a log — but remove this step
+      # once the PI_MAIN_* secrets are confirmed correct; it has no purpose beyond that diagnosis.
+      - name: Debug - verify PI_MAIN_USERNAME/PASSWORD secrets (remove after diagnosis)
+        run: |
+          echo "PI_MAIN_USERNAME length: ${#PI_MAIN_USERNAME}"
+          echo "PI_MAIN_USERNAME equals 'gitea-workflow': $([ "$PI_MAIN_USERNAME" = "gitea-workflow" ] && echo yes || echo no)"
+          echo "PI_MAIN_PASSWORD length: ${#PI_MAIN_PASSWORD}"
+        env:
+          PI_MAIN_USERNAME: ${{ secrets.PI_MAIN_USERNAME }}
+          PI_MAIN_PASSWORD: ${{ secrets.PI_MAIN_PASSWORD }}
+
       - name: Compute release timestamp
         id: release
         run: echo "timestamp=$(date -u +%Y%m%d%H%M%S)" >> "$GITHUB_OUTPUT"
@@ -56,9 +69,13 @@ jobs:
       # The backup script itself lives on the host (created once during Operations host setup) and
       # is only invoked here — no database connection string or credential is ever known to this
       # workflow, keeping D-16 ("runtime secrets live in host environment variables") intact.
-      - name: Back up database (${{ inputs.environment }})
+      # Gitea Actions does not resolve `${{ inputs.* }}` inside a step's `name:` (unlike inside
+      # `run:`, where it works fine — see the echo below) — kept static rather than showing the
+      # literal, unresolved `${{ inputs.environment }}` text in the log.
+      - name: Back up database
         if: ${{ inputs.run_db_backup }}
         run: |
+          echo "Environment: ${{ inputs.environment }}"
           sudo apt-get update && sudo apt-get install -y sshpass
           sshpass -p "${{ secrets.PI_MAIN_PASSWORD }}" ssh \
             -p ${{ secrets.PI_MAIN_PORT }} \
@@ -74,8 +91,10 @@ jobs:
       # runner with "failed to attach to container: unable to upgrade to tcp, received 409", a known
       # limitation of Podman's Docker-compatible API for the attach/log-streaming that container
       # actions rely on (D-05). A plain scp command needs no nested container.
-      - name: Upload release to ${{ inputs.environment }} (${{ inputs.transport }})
+      # Same Gitea Actions limitation as the step above — static name, value logged via echo instead.
+      - name: Upload release
         run: |
+          echo "Environment: ${{ inputs.environment }}, transport: ${{ inputs.transport }}"
           sudo apt-get update && sudo apt-get install -y sshpass
           RELEASE_DIR="${{ inputs.deploy_path }}/releases/${{ steps.release.outputs.timestamp }}"
           sshpass -p "${{ secrets.PI_MAIN_PASSWORD }}" ssh \