chore: migrate deploy + ops scripts from SSH to local execution

Replace SSH-based deploy.sh with scripts/deploy that runs locally on the
server. Update scripts/bugs, scripts/logs, and scripts/resolve-bug to drop
SSH wrappers. Update CLAUDE.md and DESIGN.md to reflect new local workflow.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

7 files changed, 61 insertions, 96 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index f3bc629..237fdaa 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -20,17 +20,17 @@ Agent roles defined in `~/.claude/roles/`.
 - **Run:** `go run cmd/dashboard/main.go`
 - **Test:** `go test ./...`
 - **Build:** `go build -o dashboard cmd/dashboard/main.go`
-- **Deploy:** `bash deploy.sh` (builds with ldflags, pushes, restarts via SSH)
+- **Deploy:** `./scripts/deploy` (builds with ldflags, syncs locally, restarts service)
 
 ## Debugging
-- **Production logs:** `bash scripts/logs` — fetches journalctl from production via SSH
-  - `bash scripts/logs -n 100` last N lines
-  - `bash scripts/logs -f` follow
-  - `bash scripts/logs --since "1 hour ago"`
-  - Pipe through `grep` to filter: `bash scripts/logs -n 500 2>&1 | grep -i error`
-- **View bugs:** `bash scripts/bugs` — lists open bugs from production database
-- **Resolve bug:** `bash scripts/resolve-bug <id>` — marks a bug as resolved
-- **Always check production logs first** when debugging reported issues
+- **Production logs:** `./scripts/logs` — fetches journalctl from the local service
+  - `./scripts/logs -n 100` last N lines
+  - `./scripts/logs -f` follow
+  - `./scripts/logs --since "1 hour ago"`
+  - Pipe through `grep` to filter: `./scripts/logs -n 500 2>&1 | grep -i error`
+- **View bugs:** `./scripts/bugs` — lists open bugs from local production database
+- **Resolve bug:** `./scripts/resolve-bug <id>` — marks a bug as resolved
+- **Always check logs first** when debugging reported issues
 
 ## Technical Context
 - **Trello is PRIMARY:** Key + Token required in query params.
diff --git a/DESIGN.md b/DESIGN.md
index c3ea49f..f7b55c8 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -68,25 +68,11 @@ task-dashboard/
 │       └── sqlite.go           # SQLite database layer
 ├── migrations/                 # SQL migration files (001-014)
 ├── scripts/
-│   ├── bugs                    # List bugs from production DB
-│   ├── logs                    # Fetch production journalctl
-│   └── resolve-bug             # Resolve a production bug
+│   ├── bugs                    # List bugs from production DB (local)
+│   ├── deploy                  # Build + local deploy to /site
+│   ├── logs                    # Fetch production journalctl (local)
+│   └── resolve-bug             # Resolve a production bug (local)
 ├── web/
-│   ├── templates/
-│   │   ├── index.html          # Main dashboard shell
-│   │   ├── login.html          # Authentication page
-│   │   ├── settings.html       # Settings + passkeys page
-│   │   ├── conditions.html     # Standalone live feeds page
-│   │   ├── shopping-mode.html  # Full-screen shopping mode
-│   │   ├── passkeys_list.html  # Passkeys list partial
-│   │   ├── agent-*.html        # Agent auth flow pages (4 files)
-│   │   └── partials/           # HTMX partial templates (12 files)
-│   └── static/
-│       ├── css/input.css       # Tailwind source
-│       ├── css/output.css      # Compiled CSS
-│       └── js/app.js           # Client-side logic + WebSocket
-├── deploy.sh                   # Build + deploy script (ldflags injection)
-└── tailwind.config.js
 ```
 
 ### Request Flow
diff --git a/deploy.sh b/deploy.sh
deleted file mode 100755
index a201d82..0000000
--- a/deploy.sh
+++ /dev/null
@@ -1,64 +0,0 @@
-#!/bin/bash
-set -e
-
-# Configuration
-REMOTE="titanium"
-FQDN="doot.terst.org"
-SITE_DIR="/site/${FQDN}"
-SERVICE="task-dashboard@${FQDN}"
-
-echo "==> Building CSS..."
-npm run css:build
-
-echo "==> Building binary (linux/amd64)..."
-BUILD_COMMIT=$(git rev-parse --short HEAD)
-BUILD_TIME=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
-LDFLAGS="-X main.buildCommit=${BUILD_COMMIT} -X main.buildTime=${BUILD_TIME}"
-GOOS=linux GOARCH=amd64 go build -ldflags "$LDFLAGS" -o app cmd/dashboard/main.go
-
-echo "==> Pushing code to ${REMOTE}..."
-git push ${REMOTE} master
-
-echo "==> Uploading binary..."
-scp app ${REMOTE}:${SITE_DIR}/app.new
-
-echo "==> Syncing assets and migrations..."
-# Sync static files (including built CSS which is git-ignored)
-rsync -avz --delete web/static/ ${REMOTE}:${SITE_DIR}/public/
-# Sync templates
-rsync -avz --delete web/templates/ ${REMOTE}:${SITE_DIR}/templates/
-# Sync migrations (required for app startup)
-rsync -avz --delete migrations/ ${REMOTE}:${SITE_DIR}/migrations/
-
-echo "==> Deploying on ${REMOTE}..."
-ssh ${REMOTE} bash -s << 'EOF'
-set -e
-FQDN="doot.terst.org"
-SITE_DIR="/site/${FQDN}"
-SERVICE="task-dashboard@${FQDN}"
-
-cd ${SITE_DIR}
-
-echo "Stopping service..."
-systemctl stop ${SERVICE} || true
-
-echo "Swapping binary..."
-mv app.new app
-
-echo "Setting permissions..."
-chown -R www-data:www-data ${SITE_DIR}
-find ${SITE_DIR} -type d -exec chmod 755 {} \;
-find ${SITE_DIR} -type f -exec chmod 644 {} \;
-chmod +x ${SITE_DIR}/app
-chmod 600 ${SITE_DIR}/.env 2>/dev/null || true
-
-echo "Starting service..."
-systemctl start ${SERVICE}
-sleep 1
-systemctl status ${SERVICE} --no-pager -l
-
-echo "Deploy complete!"
-EOF
-
-rm -f app
-echo "==> Done!"
diff --git a/scripts/bugs b/scripts/bugs
index 4f3c064..824e67a 100755
--- a/scripts/bugs
+++ b/scripts/bugs
@@ -1,4 +1,3 @@
 #!/bin/bash
 # List all bugs from the production database
-
-ssh titanium "sqlite3 -column -header /site/doot.terst.org/data/dashboard.db 'SELECT id, description, created_at FROM bugs ORDER BY id'"
+sqlite3 -column -header /site/doot.terst.org/data/dashboard.db 'SELECT id, description, created_at FROM bugs ORDER BY id'
diff --git a/scripts/deploy b/scripts/deploy
new file mode 100755
index 0000000..e6746d8
--- /dev/null
+++ b/scripts/deploy
@@ -0,0 +1,44 @@
+#!/bin/bash
+set -e
+
+# Configuration
+FQDN="doot.terst.org"
+SITE_DIR="/site/${FQDN}"
+SERVICE="task-dashboard@${FQDN}"
+
+echo "==> Building CSS..."
+npm run css:build
+
+echo "==> Building binary..."
+BUILD_COMMIT=$(git rev-parse --short HEAD)
+BUILD_TIME=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
+LDFLAGS="-X main.buildCommit=${BUILD_COMMIT} -X main.buildTime=${BUILD_TIME}"
+go build -ldflags "$LDFLAGS" -o app cmd/dashboard/main.go
+
+echo "==> Stopping service..."
+systemctl stop ${SERVICE} || true
+
+echo "==> Syncing assets and migrations to ${SITE_DIR}..."
+# Sync static files
+rsync -av --delete web/static/ ${SITE_DIR}/public/
+# Sync templates
+rsync -av --delete web/templates/ ${SITE_DIR}/templates/
+# Sync migrations
+rsync -av --delete migrations/ ${SITE_DIR}/migrations/
+
+echo "==> Swapping binary..."
+mv app ${SITE_DIR}/app
+
+echo "==> Setting permissions..."
+chown -R www-data:www-data ${SITE_DIR}
+find ${SITE_DIR} -type d -exec chmod 755 {} \;
+find ${SITE_DIR} -type f -exec chmod 644 {} \;
+chmod +x ${SITE_DIR}/app
+chmod 600 ${SITE_DIR}/.env 2>/dev/null || true
+
+echo "==> Starting service..."
+systemctl start ${SERVICE}
+sleep 1
+systemctl status ${SERVICE} --no-pager -l
+
+echo "==> Deploy complete!"
diff --git a/scripts/logs b/scripts/logs
index 7cec0c6..0259939 100755
--- a/scripts/logs
+++ b/scripts/logs
@@ -8,4 +8,4 @@
 #   scripts/logs --since "1 hour ago"
 #   scripts/logs --grep "error"
 
-ssh titanium journalctl -u task-dashboard@doot.terst.org --no-pager "$@"
+journalctl -u task-dashboard@doot.terst.org --no-pager "$@"
diff --git a/scripts/resolve-bug b/scripts/resolve-bug
index a3f0979..1fcf5df 100755
--- a/scripts/resolve-bug
+++ b/scripts/resolve-bug
@@ -10,10 +10,10 @@ BUG_ID="$1"
 
 # Show the bug being resolved
 echo "Resolving bug #$BUG_ID:"
-ssh titanium "sqlite3 -column /site/doot.terst.org/data/dashboard.db \"SELECT description FROM bugs WHERE id = $BUG_ID\""
+sqlite3 -column /site/doot.terst.org/data/dashboard.db "SELECT description FROM bugs WHERE id = $BUG_ID"
 
 # Delete the bug
-ssh titanium "sqlite3 /site/doot.terst.org/data/dashboard.db \"DELETE FROM bugs WHERE id = $BUG_ID\""
+sqlite3 /site/doot.terst.org/data/dashboard.db "DELETE FROM bugs WHERE id = $BUG_ID"
 
 if [ $? -eq 0 ]; then
     echo "Bug #$BUG_ID resolved."