Deploy test site / deploy (push) Successful in 36s
A first run failed with "Permission denied (publickey)": s1 accepts only the blog key (deploy@s1.b4l.co.th, SHA256:o4w7HL...) for the deploy user, and the secret held a different key. The SSH step now strips CR, refuses a secret that is not an unencrypted private key, and logs the key's fingerprint for comparison with authorized_keys. The ssh host alias is renamed so the masked VPS_USER value no longer hides it in the log.