846004e6d8
The Reconcile tenant API domains step ran on every push to main. On the production host that is actively harmful: api.gorbushka.market already has a hand-written vhost, and configure-api-domain.sh writes its own file per domain - so the step would hand nginx a second server block for a server_name that already has one and re-run certbot against a live API, once per deploy. Shipping frontend files needs none of it. Gate it behind a workflow_dispatch input, off by default, for standing up a NEW base domain. This also shrinks the secrets a normal deploy requires to four (DEPLOY_HOST, DEPLOY_USER, DEPLOY_SSH_KEY, DEPLOY_KNOWN_HOSTS); STOREFRONT_DOMAINS, CERTBOT_EMAIL and BACKEND_UPSTREAM are now read only on the opt-in path. Document the production host as it actually is: provisioned by hand before server-setup.sh existed, per-domain vhosts rooted at /var/www/dexarmarket/browser, which is now a symlink to /srv/marketplaces/current/frontend. Before 2026-08-22 it pointed straight at a pinned release with no `current` in between, so releases14d46ceand98c39f6uploaded successfully and were never served.