Removes the secret-diagnosis debug step, fixes wwwroot symlink parent dir

The PI_MAIN_USERNAME/PASSWORD debug step served its purpose (found the
shell-metacharacter password bug fixed in 51488d6) and is removed now
that deploy-test gets past authentication.

"Link persistent website content" then failed with `ln: failed to
create symbolic link '.../wwwroot/web': No such file or directory` -
dotnet publish only emits a wwwroot/ folder when the source project's
own wwwroot has content, so a release built before any frontend/website
content exists can land with no wwwroot/ directory at all, not merely
an empty wwwroot/web/. `ln -s` can't create the missing parent
directory itself. Added `mkdir -p $RELEASE_DIR/wwwroot` before the
existing rm/ln pair to guarantee the parent exists either way.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015FffvxxJp5wG34Ru48GBig

.gitea/workflows/deploy-scp.yaml

@@ -42,21 +42,6 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      # TEMPORARY — diagnosing a persistent "Permission denied, please try again." (sshpass exit 5)
-      # on the SSH steps below. Never prints the actual secret values, only lengths and a boolean
-      # match against the expected username, so it's safe to leave in a log — but remove this step
-      # once the PI_MAIN_* secrets are confirmed correct; it has no purpose beyond that diagnosis.
-      - name: Debug - verify PI_MAIN_USERNAME/PASSWORD secrets (remove after diagnosis)
-        run: |
-          echo "PI_MAIN_USERNAME length: ${#PI_MAIN_USERNAME}"
-          echo "PI_MAIN_USERNAME equals 'gitea-workflow': $([ "$PI_MAIN_USERNAME" = "gitea-workflow" ] && echo yes || echo no)"
-          echo "PI_MAIN_PASSWORD length: ${#PI_MAIN_PASSWORD}"
-          PW_TRIMMED="$(printf '%s' "$PI_MAIN_PASSWORD" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
-          echo "PI_MAIN_PASSWORD trimmed length: ${#PW_TRIMMED}"
-        env:
-          PI_MAIN_USERNAME: ${{ secrets.PI_MAIN_USERNAME }}
-          PI_MAIN_PASSWORD: ${{ secrets.PI_MAIN_PASSWORD }}
-
       - name: Compute release timestamp
         id: release
         run: echo "timestamp=$(date -u +%Y%m%d%H%M%S)" >> "$GITHUB_OUTPUT"
@@ -126,7 +111,10 @@ jobs:
       # first-ever deploy, before any website workspace has published anything there (U1 already
       # tolerates a missing wwwroot/web at startup). The publish output's own wwwroot/web (empty, or
       # containing only the placeholder page) is removed before the symlink is created, so it never
-      # shadows the persistent content.
+      # shadows the persistent content. `mkdir -p $RELEASE_DIR/wwwroot` guards against `ln -s` failing
+      # with "No such file or directory": dotnet publish only emits a wwwroot/ folder at all when the
+      # source project has one with actual content, so a release built before any frontend content
+      # exists can land with no wwwroot/ directory whatsoever, not merely an empty wwwroot/web/.
       - name: Link persistent website content
         env:
           SSH_USER: ${{ secrets.PI_MAIN_USERNAME }}
@@ -140,6 +128,7 @@ jobs:
             -o StrictHostKeyChecking=no \
             "$SSH_USER@$SSH_HOST" \
             "mkdir -p ${{ inputs.deploy_path }}/shared/wwwroot-web && \
+             mkdir -p $RELEASE_DIR/wwwroot && \
              rm -rf $RELEASE_DIR/wwwroot/web && \
              ln -s ../../../shared/wwwroot-web $RELEASE_DIR/wwwroot/web"