ci(deploy): clone over the LAN and bound every step

Measured on 2026-10-16: the same archive comes down at ~16 KB/s through
git.hoelee.com (Cloudflare -> tunnel -> back to this host) and ~17 MB/s from
http://192.168.1.6:3000. The shallow clone had grown to ~13 MB with the image
work and one run sat in the middle of index-pack for 13+ minutes with the job
hung. The runner is on the same host as Gitea, so it has no reason to leave the
LAN; Gitea has no 443 there, so this hop is plain HTTP on the private network
and the token stays inside it.

Also bounds the deploy: timeout-minutes 15 on the job and -m 30 on the purge
call, so a stalled Cloudflare API cannot hold a deploy open.

.gitea/workflows/deploy.yml

@@ -7,11 +7,19 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    # The runner lives on the same host as Gitea: a hang used to sit here for hours.
+    timeout-minutes: 15
     steps:
       - name: Checkout
         run: |
           git config --global --add safe.directory '*'
-          git clone --depth 1 "https://hoelee:${{ secrets.PAT }}@git.hoelee.com/hoelee/hoelee-blog.git" .
+          # Clone over the LAN, not through the public hostname. Measured 2026-10-16:
+          # git.hoelee.com goes out to Cloudflare and back through the tunnel at
+          # ~16 KB/s (13 min for a shallow clone, once hung for 13+ min mid-pack),
+          # while http://192.168.1.6:3000 serves the same archive at ~17 MB/s.
+          # Gitea has no 443 on the LAN, so this hop is plain HTTP on the private
+          # network — the token never leaves the LAN.
+          git clone --depth 1 "http://hoelee:${{ secrets.PAT }}@192.168.1.6:3000/hoelee/hoelee-blog.git" .
           git checkout $GITHUB_SHA 2>/dev/null || true
 
       - name: Install dependencies
@@ -38,10 +46,11 @@ jobs:
             exit 0
           fi
           echo "Purging zone ${CF_ZONE_ID} ..."
-          curl -sS -X POST "https://api.cloudflare.com/client/v4/zones/${CF_ZONE_ID}/purge_cache" \
+          # -m 30: a hung purge API must never hold the deploy open.
+          curl -sS -m 30 -X POST "https://api.cloudflare.com/client/v4/zones/${CF_ZONE_ID}/purge_cache" \
             -H "Authorization: Bearer ${CF_TOKEN}" \
             -H "Content-Type: application/json" \
-            --data '{"purge_everything":true}' | head -c 400
+            --data '{"purge_everything":true}' | head -c 400 || echo "purge call failed (deploy already done)"
           echo
         env:
           CF_TOKEN: ${{ secrets.CF_TOKEN }}