feat(deploy): add Contabo release workflow and portal payload gate

www/tools/deploy-rollback.mjs

@@ -0,0 +1,24 @@
+/** Reactivate one retained, reviewed Contabo release. No build or NixOS action. */
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { sshTarget } from './deploy.mjs';
+
+const sha = /^[0-9a-f]{40}$/;
+function fail(message) { throw new Error(message); }
+function run(command, args) {
+  const result = spawnSync(command, args, { encoding: 'utf8' });
+  if (result.error || result.status !== 0) fail(`${command} failed${result.stderr ? `: ${result.stderr.trim()}` : ''}`);
+  if (result.stdout) process.stdout.write(result.stdout);
+}
+function main() {
+  const [release, confirmation] = process.argv.slice(2);
+  if (!sha.test(release ?? '') || confirmation !== '--confirm' || process.argv.length !== 4) fail('Usage: npm run deploy:rollback -- FULL_APPROVED_SHA --confirm');
+  const [ssh, ...options] = sshTarget(process.env.AIA_DEPLOY_HOST, process.env.AIA_DEPLOY_SSH_IDENTITY);
+  // The release manager verifies the stored release and manifest before its
+  // atomic symlink update. The SHA is strictly validated before interpolation.
+  run(ssh, [...options, process.env.AIA_DEPLOY_HOST, `aia-website-release rollback /root/aia-site-${release}.manifest.json && readlink /srv/www/azinstitute4autism.com/www/dist`]);
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try { main(); } catch (error) { console.error(`Rollback stopped: ${error.message}`); process.exitCode = 1; }
+}