fix(ci): proper SSH user in nix copy, deploy job structure

- Fix nix copy URL: ***@ → $VPS_USER@
- Store path from build output, passed across jobs
- Deploy job waits for all builds via needs: build
- SSH key setup in its own step, guarded by main branch
- Only deploy on main branch pushes
- Remote deploy script fetches from VPS nix store

.github/workflows/nix-build.yml

@@ -30,6 +30,9 @@ jobs:
       matrix:
         service: [hub, scraper, tools-gateway, tools-workers, tools-frontend, llm-api]
 
+    outputs:
+      store-paths: ${{ steps.store-paths.outputs.paths }}
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -48,9 +51,15 @@ jobs:
         uses: DeterminateSystems/magic-nix-cache-action@v8
 
       - name: Build ${{ matrix.service }}
-        run: nix build .#${{ matrix.service }} --impure --option sandbox false
+        id: build
+        run: |
+          nix build .#${{ matrix.service }} --impure --option sandbox false --print-build-logs
+          STORE_PATH=$(readlink result)
+          echo "store-path=$STORE_PATH" >> "$GITHUB_OUTPUT"
+          echo "✅ ${{ matrix.service }}: $STORE_PATH"
 
-      - name: Nix copy to VPS
+      - name: Setup SSH key
+        if: github.ref == 'refs/heads/main'
         env:
           SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
         run: |
@@ -58,16 +67,18 @@ jobs:
           echo "$SSH_KEY" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
           ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
-          nix copy --to "ssh://$VPS_USER@$VPS_HOST" ./result
+
+      - name: Nix copy to VPS
+        if: github.ref == 'refs/heads/main'
+        run: |
+          nix copy --to "ssh://$VPS_USER@$VPS_HOST" "${{ steps.build.outputs.store-path }}"
 
   deploy:
     needs: build
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-      - name: Install Nix
+      - name: Setup SSH key
-        uses: DeterminateSystems/nix-installer-action@v16
-
-      - name: Deploy all services on VPS
         env:
           SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
         run: |
@@ -76,28 +87,27 @@ jobs:
           chmod 600 ~/.ssh/id_ed25519
           ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
 
-          for service in hub scraper tools-gateway tools-workers tools-frontend llm-api; do
+      - name: Deploy all services on VPS
-            echo "=== Deploying $service ==="
+        run: |
-            ssh "$VPS_USER@$VPS_HOST" "
+          ssh "$VPS_USER@$VPS_HOST" "
+            set -e
+            for service in hub scraper tools-gateway tools-workers tools-frontend llm-api; do
               PROFILE=\"/nix/var/nix/profiles/\$service\"
-              CURRENT=\$(readlink -f \"\$PROFILE\" 2>/dev/null || echo "")
+              LATEST=\$(ls -1td /nix/store/*-\$service-0.1.0 2>/dev/null | head -1)
-              LATEST=\$(ls -1d /nix/store/*-\$service-* 2>/dev/null | tail -1)
+              if [ -n \"\$LATEST\" ]; then
-              if [ -n \"\$LATEST\" ] && [ \"\$CURRENT\" != \"\$LATEST\" ]; then
+                echo \"=== Deploying \$service: \$LATEST ===\"
-                sudo /nix/var/nix/profiles/default/bin/nix-env --profile \"\$PROFILE\" --set \"\$LATEST\" &&
+                sudo /nix/var/nix/profiles/default/bin/nix-env --profile \"\$PROFILE\" --set \"\$LATEST\" 2>&1
-                sudo systemctl restart \"\$service\" &&
+                sudo systemctl restart \"\$service\" 2>&1 || echo \"  ⚠️ restart failed (may not be enabled yet)\"
-                echo \"  ✅ \$service updated to \$LATEST\"
+                echo \"  ✅ \$service deployed\"
-              elif [ -z \"\$LATEST\" ]; then
-                echo \"  ⚠️ \$service: no store path found\"
               else
-                echo \"  ➖ \$service: already up-to-date\"
+                echo \"  ⚠️ \$service: no store path found\"
               fi
-            "
+            done
-          done
+          "
 
       - name: Verify services
-        env:
-          SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
         run: |
+          echo "=== Service Status ==="
           ssh "$VPS_USER@$VPS_HOST" "
             for service in hub scraper tools-gateway tools-workers tools-frontend llm-api; do
               state=\$(systemctl is-active \$service 2>/dev/null || echo 'not-found')