Homepage (TDD slice 6): the git-driven deploy

Red tests first.
- tests/homepage_deploy.bats: the deploy ships the homepage (assets to
  /srv/homepage, the checker timer, both Caddy hashes, deployed.js) and is
  git-driven (pulls main); the checker runs as a systemd timer.
- scripts/homepage-status.service / .timer: the checker as a oneshot service
  + a 3-minute timer (Q2/Q35).
- scripts/deploy.sh: the Caddyfile render now substitutes BOTH hashes
  (REPLACE_WITH_HASH <- CADDY_BASICAUTH_HASH, REPLACE_WITH_ADMIN_HASH <-
  CADDY_ADMIN_HASH). A new homepage step copies the assets to /srv/homepage,
  generates deployed.js from the deployed commit's datetime (Q43), installs
  the checker timer, and runs the checker once so status.json exists at once.
- tests/llm_units.bats: scoped the three LLM-unit tests to
  frank-default-*.service (the homepage unit is a different pattern: it
  installs to /usr/local/bin and runs from /srv at deploy time).

tests/homepage_deploy.bats

@@ -0,0 +1,30 @@
+#!/usr/bin/env bats
+# Seam: scripts/deploy.sh deploys the homepage, and the checker runs as a
+# systemd timer. The deploy is git-driven (master = the deployed state, Q33).
+# The tests assert the deploy references the homepage steps and renders BOTH
+# hashes, and that the checker timer + service exist and point at the checker.
+
+load helpers
+
+@test "deploy.sh ships the homepage (assets, timer, both hashes, deployed.js)" {
+    local d="$REPO_ROOT/scripts/deploy.sh"
+    grep -q "/srv/homepage" "$d"
+    grep -q "homepage-status" "$d"
+    grep -q "CADDY_BASICAUTH_HASH" "$d"
+    grep -q "CADDY_ADMIN_HASH" "$d"
+    grep -q "deployed.js" "$d"
+}
+
+@test "the checker runs as a systemd timer pointing at the checker" {
+    local s="$REPO_ROOT/scripts/homepage-status.service"
+    local t="$REPO_ROOT/scripts/homepage-status.timer"
+    [ -f "$s" ]
+    [ -f "$t" ]
+    grep -q "homepage-status.py" "$s"
+    grep -q "OnUnitActiveSec" "$t"
+    grep -q "homepage-status.service" "$t"
+}
+
+@test "deploy.sh is git-driven: it pulls main on the target" {
+    grep -q "git pull origin main" "$REPO_ROOT/scripts/deploy.sh"
+}

tests/llm_units.bats

@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
 # Seam: LLM systemd unit integrity.
-# Every scripts/*.service unit must point at files that exist in this repo.
+# Every LLM unit (frank-default-*.service) must point at files that exist in
+# this repo. The homepage-status unit is a different pattern (it installs to
+# /usr/local/bin and runs from /srv at deploy time) and is not checked here.
 # The units reference absolute paths on the target checkout
 # (/home/dank/serverAppConfigs/...); the relative part of each path must
 # resolve to a tracked file here. A unit that points at a retired checkout
@@ -48,7 +50,7 @@ unit_repo_path() {
             echo "$bad"
             return 1
         fi
-    done < <(find "$REPO_ROOT/scripts" -name '*.service' -type f | sort)
+    done < <(find "$REPO_ROOT/scripts" -name 'frank-default-*.service' -type f | sort)
     [ "$any" -eq 1 ] || skip "no LLM units yet"
 }
 
@@ -63,7 +65,7 @@ unit_repo_path() {
             echo "unit $(basename "$unit") env file $envfile not in repo"
             return 1
         }
-    done < <(find "$REPO_ROOT/scripts" -name '*.service' -type f | sort)
+    done < <(find "$REPO_ROOT/scripts" -name 'frank-default-*.service' -type f | sort)
 }
 
 @test "LLM serve scripts exist for every unit" {
@@ -76,5 +78,5 @@ unit_repo_path() {
             echo "unit $svc: ExecStart script $script not in repo"
             return 1
         }
-    done < <(find "$REPO_ROOT/scripts" -name '*.service' -type f | sort)
+    done < <(find "$REPO_ROOT/scripts" -name 'frank-default-*.service' -type f | sort)
 }