Homepage (TDD slice 6): the git-driven deploy

Red tests first.
- tests/homepage_deploy.bats: the deploy ships the homepage (assets to
  /srv/homepage, the checker timer, both Caddy hashes, deployed.js) and is
  git-driven (pulls main); the checker runs as a systemd timer.
- scripts/homepage-status.service / .timer: the checker as a oneshot service
  + a 3-minute timer (Q2/Q35).
- scripts/deploy.sh: the Caddyfile render now substitutes BOTH hashes
  (REPLACE_WITH_HASH <- CADDY_BASICAUTH_HASH, REPLACE_WITH_ADMIN_HASH <-
  CADDY_ADMIN_HASH). A new homepage step copies the assets to /srv/homepage,
  generates deployed.js from the deployed commit's datetime (Q43), installs
  the checker timer, and runs the checker once so status.json exists at once.
- tests/llm_units.bats: scoped the three LLM-unit tests to
  frank-default-*.service (the homepage unit is a different pattern: it
  installs to /usr/local/bin and runs from /srv at deploy time).

scripts/deploy.sh

@@ -160,18 +160,36 @@ if [ '${COPY_SHARED[$TARGET]}' = '1' ]; then
   cp shared/loki/loki-config.yaml /opt/loki/config/loki-config.yaml
   cp shared/alloy/config.alloy /opt/alloy/config/config.alloy
 
-  echo '  Rendering Caddyfile (basicauth hash from .env)...'
-  # Extract the hash with grep/cut rather than sourcing .env: sourcing a
+  echo '  Rendering Caddyfile (basicauth hashes from .env)...'
+  # Extract the hashes with grep/cut rather than sourcing .env: sourcing a
   # bcrypt value in a set -u shell dies on its dollar-sign expansion.
   CADDY_BASICAUTH_HASH=\"\$(grep -E '^CADDY_BASICAUTH_HASH=' .env | tail -1 | cut -d= -f2-)\"
-  if [ -z \"\${CADDY_BASICAUTH_HASH}\" ]; then
-    echo '  WARN: CADDY_BASICAUTH_HASH not set in .env; keeping placeholder'
-  else
+  CADDY_ADMIN_HASH=\"\$(grep -E '^CADDY_ADMIN_HASH=' .env | tail -1 | cut -d= -f2-)\"
+  if [ -n \"\${CADDY_BASICAUTH_HASH}\" ] && [ -n \"\${CADDY_ADMIN_HASH}\" ]; then
     # '|' delimiter: the bcrypt hash contains '/' characters.
     mkdir -p /home/dank/Containers/caddy
-    sed \"s|REPLACE_WITH_HASH|\${CADDY_BASICAUTH_HASH}|g\" dankclaw/Caddyfile \\
-      > /home/dank/Containers/caddy/Caddyfile
+    sed -e \"s|REPLACE_WITH_HASH|\${CADDY_BASICAUTH_HASH}|g\" \\
+        -e \"s|REPLACE_WITH_ADMIN_HASH|\${CADDY_ADMIN_HASH}|g\" \\
+      dankclaw/Caddyfile > /home/dank/Containers/caddy/Caddyfile
+  else
+    echo '  WARN: a Caddy hash is not set in .env; keeping the placeholder(s)'
   fi
+
+  echo '  Deploying the homepage...'
+  mkdir -p /srv/homepage
+  cp shared/homepage/index.html shared/homepage/admin.html shared/homepage/app.js \\
+     shared/homepage/style.css shared/homepage/services.json /srv/homepage/
+  [ -d shared/homepage/fonts ] && cp -r shared/homepage/fonts /srv/homepage/
+  # The last master deployment datetime (Q43): the deployed commit's datetime.
+  DEPLOYED_AT=\"\$(git log -1 --format=%cI)\"
+  printf 'window.DEPLOYED_AT = \"%s\";\\n' \"\$DEPLOYED_AT\" > /srv/homepage/deployed.js
+  # The status checker: install the timer + service, run it once, enable it.
+  ${SUDO} cp scripts/homepage-status.py /usr/local/bin/homepage-status.py
+  ${SUDO} cp scripts/homepage-status.service scripts/homepage-status.timer /etc/systemd/system/
+  ${SUDO} systemctl daemon-reload
+  ${SUDO} systemctl enable homepage-status.timer
+  ${SUDO} systemctl restart homepage-status.timer
+  python3 /usr/local/bin/homepage-status.py /srv/homepage/services.json /srv/homepage/status.json
 fi
 
 if [ '${COMPOSE_UP[$TARGET]}' = '1' ]; then

scripts/homepage-status.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=Homepage status checker (probes backends, writes status.json)
+After=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/python3 /usr/local/bin/homepage-status.py /srv/homepage/services.json /srv/homepage/status.json

scripts/homepage-status.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Run the homepage status checker every 3 minutes
+
+[Timer]
+OnBootSec=1min
+OnUnitActiveSec=3min
+Unit=homepage-status.service
+
+[Install]
+WantedBy=timers.target