ci: fix deploy - use docker service update instead of stack deploy

Co-authored-by: Jason Woltje <jason@diversecanvas.com>
Co-committed-by: Jason Woltje <jason@diversecanvas.com>

.woodpecker/ci.yml

@@ -337,3 +337,42 @@ steps:
       - security-trivy-api
       - security-trivy-orchestrator
       - security-trivy-web
+
+  # ─── Deploy to Docker Swarm (main only) ─────────────────────
+
+  deploy-swarm:
+    image: alpine:3
+    environment:
+      SSH_PRIVATE_KEY:
+        from_secret: ssh_private_key
+      SSH_KNOWN_HOSTS:
+        from_secret: ssh_known_hosts
+      GITEA_USER:
+        from_secret: gitea_username
+      GITEA_TOKEN:
+        from_secret: gitea_token
+    commands:
+      - apk add --no-cache openssh-client
+      - |
+        set -e
+        # Setup SSH
+        mkdir -p ~/.ssh
+        echo "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
+        chmod 600 ~/.ssh/known_hosts
+        echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
+        chmod 600 ~/.ssh/id_ed25519
+
+        # Deploy to swarm - force update to pull new images
+        echo "🚀 Deploying to Docker Swarm..."
+        ssh -o StrictHostKeyChecking=no localadmin@10.1.1.45 \
+          "docker login git.mosaicstack.dev -u \$GITEA_USER -p \$GITEA_TOKEN && \
+           docker service update --force mosaic_api && \
+           docker service update --force mosaic_web && \
+           docker service update --force mosaic_orchestrator && \
+           docker service update --force mosaic_coordinator && \
+           echo '✅ All services updated'"
+    when:
+      - branch: [main]
+        event: [push, manual, tag]
+    depends_on:
+      - link-packages