ci: use localadmin user for deploy

- Added GET /orchestrator/health for widget health checks
- Added GET /orchestrator/events/recent for recent agent events
- Widgets were calling endpoints that returned 404

.woodpecker/ci.yml

@@ -340,8 +340,6 @@ steps:
 
   # ─── Deploy to Docker Swarm (main only) ─────────────────────
 
-  # ─── Deploy to Docker Swarm via Portainer (main only) ─────────────────────
-
   deploy-swarm:
     image: alpine:3
     environment:
@@ -349,30 +347,23 @@ steps:
         from_secret: ssh_private_key
       SSH_KNOWN_HOSTS:
         from_secret: ssh_known_hosts
-      PORTAINER_URL:
-        from_secret: portainer_url
-      PORTAINER_API_KEY:
-        from_secret: portainer_api_key
     commands:
-      - apk add --no-cache curl openssh-client
+      - apk add --no-cache openssh-client
       - |
         set -e
-        echo "🚀 Deploying to Docker Swarm..."
+        # Setup SSH
-
-        # Setup SSH for fallback
         mkdir -p ~/.ssh
         echo "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
         chmod 600 ~/.ssh/known_hosts
         echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
         chmod 600 ~/.ssh/id_ed25519
 
-        # Force service updates (images are pulled from public registry)
+        # Deploy to swarm
+        echo "🚀 Deploying to Docker Swarm..."
         ssh -o StrictHostKeyChecking=no localadmin@10.1.1.45 \
-          "docker service update --with-registry-auth --force mosaic-stack-api && \
+          "cd /opt/mosaic-stack && \
-           docker service update --with-registry-auth --force mosaic-stack-web && \
+           docker login git.mosaicstack.dev -u \$(echo \$GITEA_USER) -p \$GITEA_TOKEN || true && \
-           docker service update --with-registry-auth --force mosaic-stack-orchestrator && \
+           docker stack deploy -c docker-compose.yml mosaic"
-           docker service update --with-registry-auth --force mosaic-stack-coordinator && \
-           echo '✅ All services updated'"
     when:
       - branch: [main]
         event: [push, manual, tag]