Deploy to a single target

There is only one server. The site is served from /var/www/mcg on the VPS
at mcg.luxick.de today, and the main domain will be pointed at the same
instance at cutover; local `hugo server` covers development.

Drops the development/production split from the workflow, its
DEPLOY_PATH_DEV / DEPLOY_PATH_PROD secrets and the workflow_dispatch
environment input, leaving a single DEPLOY_PATH. baseURL now comes from
hugo.toml rather than being injected per environment, so it is the one
place to change at cutover.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -2,8 +2,9 @@
 
 Static website of the Motorradclub Giebelwald e.V., built with [Hugo](https://gohugo.io).
 
-- Development: <https://mcg.luxick.de>
-- Production: <https://motorradclub-giebelwald.de>
+Currently served at <https://mcg.luxick.de>. Once the site is signed off, the
+main domain <https://motorradclub-giebelwald.de> will be pointed at the same
+server and the old host retired — see [Changing the domain](#changing-the-domain).
 
 ## Requirements
 
@@ -91,12 +92,15 @@ layouts/                 baseof, home, list, page, termine
 
 ## Deployment
 
-`.gitea/workflows/deploy.yml` builds with Hugo and rsyncs `public/` over SSH.
+`.gitea/workflows/deploy.yml` builds with Hugo and rsyncs `public/` over SSH to
+the VPS webroot.
 
-- Push to `main` → deploys to **mcg.luxick.de**
-- Manual *Run workflow* with `environment: production` → deploys to
-  **motorradclub-giebelwald.de**
-- Pull requests are built but never published
+- Push to `main` → builds and deploys
+- *Run workflow* → manual re-deploy of the current `main`
+- Pull requests are built to catch breakage, but never published
+
+There is one deploy target. For development, run the site locally with
+`hugo server`.
 
 ### Required secrets
 
@@ -105,12 +109,21 @@ Set these in the Gitea repository settings:
 | Secret | Example |
 |---|---|
 | `SSH_PRIVATE_KEY` | Deploy key with write access to the webroot |
-| `SSH_KNOWN_HOSTS` | Output of `ssh-keyscan <host>` |
+| `SSH_KNOWN_HOSTS` | Verified output of `ssh-keyscan <host>` |
 | `DEPLOY_HOST` | `server.example.de` |
 | `DEPLOY_USER` | `www-deploy` |
-| `DEPLOY_PATH_DEV` | `/var/www/mcg-dev` |
-| `DEPLOY_PATH_PROD` | `/var/www/mcg` |
+| `DEPLOY_PATH` | `/var/www/mcg` |
 
-rsync runs with `--delete`, so each `DEPLOY_PATH_*` must point at a directory
-owned solely by this site. The workflow refuses to deploy if the path is unset,
-too shallow, or if the build produced no `index.html`.
+rsync runs with `--delete`, so `DEPLOY_PATH` must point at a directory owned
+solely by this site. The workflow refuses to deploy if the path is unset, too
+shallow, or if the build produced no `index.html`.
+
+### Changing the domain
+
+`baseURL` in `hugo.toml` is the only place the live domain is configured; it
+feeds canonical URLs, `og:url`, the RSS feed and the sitemap. To cut over:
+
+1. Point the DNS record at the VPS.
+2. Add the domain to the nginx `server_name` and reissue the certificate.
+3. Change `baseURL` in `hugo.toml` and push — the deploy rebuilds every
+   absolute URL.