Add start script to package.json and enhance CI workflow for deployment

- Introduced a new "start" script in package.json to run the built application.
- Updated the CI workflow to include environment variables for deployment.
- Added steps for uploading build artifacts and deploying to a server using sshpass.
- Configured the deployment process to ensure the application runs on the specified port.

.gitea/workflows/ci.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
     branches: [main]
 
+env:
+  DEPLOY_HOST: "10.10.1.82"
+  DEPLOY_PORT: "3010"
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -25,6 +29,40 @@ jobs:
       - name: Build
         run: bun run build
         env:
-          PORT: "3010"
-          # Build-time env (VITE_* for client; POCKETBASE_URL has fallback in code)
+          PORT: ${{ env.DEPLOY_PORT }}
           VITE_POCKETBASE_URL: ${{ vars.VITE_POCKETBASE_URL || 'https://pocketbase.ccllc.pro' }}
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: app
+          path: |
+            build
+            package.json
+            bun.lockb
+
+  deploy:
+    needs: build
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download build artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: app
+
+      - name: Install sshpass
+        run: sudo apt-get update -qq && sudo apt-get install -y sshpass
+
+      - name: Deploy to server
+        env:
+          DEPLOY_HOST: ${{ env.DEPLOY_HOST }}
+          DEPLOY_PORT: ${{ env.DEPLOY_PORT }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          DEPLOY_PASSWORD: ${{ secrets.DEPLOY_PASSWORD }}
+        run: |
+          set -e
+          ssh-keyscan -H $DEPLOY_HOST >> ~/.ssh/known_hosts 2>/dev/null || true
+          sshpass -p "$DEPLOY_PASSWORD" ssh -o StrictHostKeyChecking=accept-new $DEPLOY_USER@$DEPLOY_HOST "mkdir -p /var/www/hrm"
+          sshpass -p "$DEPLOY_PASSWORD" scp -o StrictHostKeyChecking=accept-new -r build package.json bun.lockb $DEPLOY_USER@$DEPLOY_HOST:/var/www/hrm/
+          sshpass -p "$DEPLOY_PASSWORD" ssh -o StrictHostKeyChecking=accept-new $DEPLOY_USER@$DEPLOY_HOST "cd /var/www/hrm && bun install --frozen-lockfile && pkill -f 'node build' || true; PORT=$DEPLOY_PORT nohup node build > /var/log/hrm.log 2>&1 &"