refactor: switch from FTPS/lftp to rsync for deployment

Replace the FTPS-based deployment approach with rsync over SSH for more
reliable and efficient mirroring of the Hugo site. This change addresses
issues with the previous approach and provides true mirror behavior.

Key changes:
- Replace lftp with rsync for file synchronization
- Add --delete flag for true mirror behavior (removes stale remote files)
- Simplify authentication to use SSH keys only (no password needed)
- Update all documentation and OpenSpec artifacts
- Add .envrc to gitignore for direnv users

Environment variables:
- SSH_USER: SSH username (required)
- SSH_HOST: server hostname (required)
- SSH_PORT: SSH port (optional, defaults to 22)
- REMOTE_ROOT: remote directory path (optional, defaults to /httpsdocs)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

openspec/changes/add-ftps-deployment/specs/deployment/spec.md

@@ -2,29 +2,30 @@
 
 ## ADDED Requirements
 
-### Requirement: FTPS Deployment Script SHALL be provided
-The system SHALL provide an automated deployment script that uploads the built Hugo site to the production server via FTPS.
+### Requirement: Rsync Deployment Script SHALL be provided
+The system SHALL provide an automated deployment script that syncs the built Hugo site to the production server via rsync over SSH, properly mirroring content.
 
 #### Scenario: User deploys site after building
 **Given** the Hugo site has been built successfully (public/ directory exists)
-**And** the user has set the FTPS_PASSWORD environment variable
+**And** the user has set the SSH_USER and SSH_HOST environment variables
 **When** the user runs the deployment script
-**Then** the script connects to www.markusgraf.ch via FTPS using the username "gurix"
-**And** uploads all files from the public/ directory to the httpsdocs/ directory on the server
-**And** displays upload progress and completion status
+**Then** the script connects to the specified SSH_HOST via rsync over SSH
+**And** syncs all files from the public/ directory to the REMOTE_ROOT directory on the server
+**And** deletes remote files that don't exist locally (mirror behavior)
+**And** displays sync progress and completion status
 **And** exits with status code 0 on success
 
 #### Scenario: Script fails when credentials are missing
 **Given** the Hugo site has been built
-**And** the FTPS_PASSWORD environment variable is not set
+**And** the SSH_USER or SSH_HOST environment variable is not set
 **When** the user runs the deployment script
-**Then** the script displays an error message explaining the missing credential
+**Then** the script displays an error message explaining the missing configuration
 **And** exits with a non-zero status code
 **And** does not attempt to connect to the server
 
 #### Scenario: Script handles connection failures gracefully
-**Given** the FTPS_PASSWORD is set correctly
-**And** the network connection to www.markusgraf.ch is unavailable or fails
+**Given** the SSH_USER and SSH_HOST are set correctly
+**And** the network connection to the server is unavailable or SSH authentication fails
 **When** the user runs the deployment script
 **Then** the script displays a clear error message about the connection failure
 **And** exits with a non-zero status code
@@ -33,18 +34,19 @@ The system SHALL provide an automated deployment script that uploads the built H
 ### Requirement: Secure Credential Management SHALL be enforced
 The deployment process SHALL handle credentials securely without exposing them in version control or script output.
 
-#### Scenario: Credentials stored as environment variables
+#### Scenario: Configuration stored as environment variables
 **Given** the user needs to deploy the site
 **When** the user reviews the deployment documentation
-**Then** the documentation instructs them to set FTPS_PASSWORD as an environment variable
-**And** the deployment script reads credentials only from environment variables
+**Then** the documentation instructs them to set SSH_USER, SSH_HOST, SSH_PORT, and REMOTE_ROOT as environment variables
+**And** the deployment script reads configuration only from environment variables
 **And** credentials are never hardcoded in scripts or configuration files
+**And** SSH key-based authentication is used for secure, password-less access
 
 #### Scenario: Script does not expose credentials in output
 **Given** the deployment script is running
 **When** the script displays status messages or logs
-**Then** the password is never displayed in plain text
-**And** connection strings mask the password portion
+**Then** SSH keys or passwords are never displayed in plain text
+**And** connection strings show only the host and user information
 **And** error messages do not reveal credential values
 
 ### Requirement: Deployment Status Feedback SHALL be provided
@@ -84,6 +86,13 @@ The deployment script SHALL verify that prerequisites are met before attempting
 #### Scenario: Script checks for required tools
 **Given** the deployment script starts
 **When** it performs prerequisite checks
-**Then** it verifies that lftp is installed and available
-**And** displays an installation message if lftp is missing
+**Then** it verifies that rsync is installed and available
+**And** displays an installation message if rsync is missing
 **And** exits with an error if required tools are unavailable
+
+#### Scenario: Script supports configurable ports and remote directories
+**Given** the user needs to deploy to a non-standard SSH port or directory
+**When** the user sets SSH_PORT and REMOTE_ROOT environment variables
+**Then** the script uses the specified port instead of the default (22)
+**And** the script uploads to the specified remote directory instead of the default (/httpsdocs)
+**And** if these variables are not set, the script uses sensible defaults