fix(deploy): reclaim www-data ownership before git reset

Stale host sources survived reset when files were owned by www-data, leaving an old nitro editor with a removed Json type that failed typecheck.

Co-authored-by: Cursor <[email protected]>

.gitea/workflows/deploy.yaml

@@ -33,6 +33,14 @@ jobs:
           # 2. Navigate to your website directory
           cd /var/www/atom-nexst/
 
+          DEPLOY_USER="$(id -un)"
+          DEPLOY_GROUP="$(id -gn)"
+
+          # CRITICAL: last deploy chowns the tree to www-data. Reclaim ownership
+          # BEFORE git reset, otherwise stale sources (e.g. old nitro editor with
+          # a removed Json type) can survive and break typecheck.
+          sudo chown -R "${DEPLOY_USER}:${DEPLOY_GROUP}" /var/www/atom-nexst/
+
           # CRITICAL: Prevent Git permission blocks caused by the www-data ownership change
           git config --global --add safe.directory /var/www/atom-nexst
 
@@ -44,6 +52,8 @@ jobs:
           git reset --hard origin/main
           # Drop stray untracked sources left on the host (keep secrets/env).
           git clean -fd -e .env -e .env.local -e .env.production -e .env*.local -- src
+          # Force-refresh sources after reclaiming ownership (belt-and-suspenders).
+          git checkout -f HEAD -- src
 
           # Preserve .next/cache so Next.js can reuse its incremental build cache.
           rm -rf .output dist
@@ -53,6 +63,12 @@ jobs:
           export NEXT_PUBLIC_APP_VERSION="${APP_VERSION}"
           echo "APP_VERSION=${APP_VERSION}"
 
+          # Fail fast if a host-local stale copy still has the removed Json type.
+          if grep -nE ':\s*Json\b|Json\s*\|' src/app/admin/import/furni/nitro-editor-dialog.tsx; then
+            echo "ERROR: nitro-editor-dialog.tsx still contains a Json type after checkout" >&2
+            exit 1
+          fi
+
           # 4. Install — onlyBuiltDependencies comes from pnpm-workspace.yaml
           # (do not set a PNPM only-built-deps env override here).
           pnpm install --frozen-lockfile