Add a workstation deploy script

The Gitea runner is not up yet, so deploys need to be possible by hand.
scripts/deploy.sh mirrors the workflow: same hugo build, same rsync
invocation, same DEPLOY_PATH guards.

It previews every change and reports the number of server-side deletions
before asking to continue, since rsync runs with --delete. Credentials
live in the gitignored scripts/deploy.env.

Two Windows-specific guards, both hit in practice: it refuses an SSH key
under /mnt (WSL cannot hold 0600 there, so ssh rejects it) and it fails
with a clear message when run from Git Bash, which has no rsync.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -5,3 +5,6 @@
 
 # Local scratch space
 /.cache/
+
+# Local deploy credentials
+/scripts/deploy.env