fix: wire credential files into service environment/ dirs on setup and deploy

deploy/deploy-public.sh

@@ -5,8 +5,8 @@
 # Expects in ${APP_HOME}/staging/:
 #   deepdrft-public.tar.gz   -- published self-contained linux-x64 binary tree
 #
-# DeepDrftPublic receives its API URL credential via systemd LoadCredential
-# (api-public.json -> $CREDENTIALS_DIRECTORY/api at runtime). No env file copy needed.
+# DeepDrftPublic reads its API URL credential from environment/api.json at startup
+# (populated by setup-step10-creds.sh). The env-file copy block below keeps it current.
 #
 # Paths are derived at runtime — no hardcoded usernames or home dirs.
 # APP_HOME comes from $HOME (sshd sets this for the app user).
@@ -36,6 +36,18 @@ rm -f "${STAGING}/${ARCHIVE}"
 
 echo "[deploy-public] archive extracted"
 
+# ── Apply environment files (host-managed, not in archive) ────────────────
+if [[ -d "${APPROOT}/environment" ]]; then
+  shopt -s nullglob
+  env_files=("${APPROOT}/environment/"*)
+  shopt -u nullglob
+  if [[ ${#env_files[@]} -gt 0 ]]; then
+    mkdir -p "${APPROOT}/bin/environment"
+    cp "${env_files[@]}" "${APPROOT}/bin/environment/"
+    echo "[deploy-public] environment files applied"
+  fi
+fi
+
 # ── Enable and restart service ─────────────────────────────────────────────
 systemctl --user enable deepdrftpublic.service
 systemctl --user restart deepdrftpublic.service