Deploy workflow: check the SSH key and log its fingerprint

A first run failed with "Permission denied (publickey)": s1 accepts only
the blog key (deploy@s1.b4l.co.th, SHA256:o4w7HL...) for the deploy user,
and the secret held a different key. The SSH step now strips CR, refuses
a secret that is not an unencrypted private key, and logs the key's
fingerprint for comparison with authorized_keys. The ssh host alias is
renamed so the masked VPS_USER value no longer hides it in the log.

site/README.md

@@ -64,7 +64,12 @@ go into `public/` instead.
    Gitea secrets cannot be read back, so they are entered again here from
    the private key file; repo secrets set on `B4L/buildfor_life_web` do not
    reach this repository, B4L organisation secrets only reach it if it moves
-   into B4L. If the private key file is gone, make a new key instead:
+   into B4L. The blog key is `deploy@s1.b4l.co.th`, fingerprint
+   `SHA256:o4w7HL+EsPI3MXbbcYWGn0EykN7qeLtYg0Tc9FI1a3s`, and it is the only
+   key in `/home/deploy/.ssh/authorized_keys` on s1 (sshd on port 2255, so
+   `VPS_PORT` is 2255). The deploy log prints the fingerprint of the key in
+   `VPS_SSH_KEY`; if it differs, the server answers
+   "Permission denied (publickey)". If the private key is gone, make a new key instead:
    `ssh-keygen -t ed25519 -N "" -C cnx_vinyl-deploy -f cnx_vinyl-deploy`,
    public half into the deploy user's `~/.ssh/authorized_keys` on s1,
    private half into `VPS_SSH_KEY`, then delete the local copy.