Accept base64 or PEM for DEPLOY_SSH_KEY in docker-deploy

Match magpie/tarakan so base64-encoded Actions secrets work.

.forgejo/workflows/docker-deploy.yml

@@ -123,12 +123,25 @@ jobs:
         run: |
           set -euo pipefail
           install -m 700 -d ~/.ssh
-          # Secret may arrive with literal \n — normalize to real newlines
-          printf '%s\n' "$DEPLOY_SSH_KEY" | sed 's/\r$//' | sed 's/\\n/\n/g' > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
+          # Secrets may be raw PEM or base64(PEM) — accept either.
+          write_key() {
+            local src="$1" dest="$2"
+            if printf '%s' "$src" | grep -q 'BEGIN .*PRIVATE KEY'; then
+              printf '%s\n' "$src" | sed 's/\r$//' | sed 's/\\n/\n/g' > "$dest"
+            else
+              printf '%s' "$src" | tr -d '\n\r ' | base64 -d > "$dest"
+            fi
+            chmod 600 "$dest"
+          }
+          write_key "$DEPLOY_SSH_KEY" ~/.ssh/id_ed25519
           : > ~/.ssh/known_hosts
           if [ -n "${DEPLOY_SSH_HOST_KEY:-}" ]; then
-            printf '%s\n' "$DEPLOY_SSH_HOST_KEY" | sed 's/\r$//' | sed 's/\\n/\n/g' >> ~/.ssh/known_hosts
+            if printf '%s' "$DEPLOY_SSH_HOST_KEY" | grep -q 'ssh-'; then
+              printf '%s\n' "$DEPLOY_SSH_HOST_KEY" | sed 's/\r$//' | sed 's/\\n/\n/g' >> ~/.ssh/known_hosts
+            else
+              printf '%s' "$DEPLOY_SSH_HOST_KEY" | tr -d '\n\r ' | base64 -d >> ~/.ssh/known_hosts
+              printf '\n' >> ~/.ssh/known_hosts
+            fi
           fi
           # Always pin live host keys so BatchMode never prompts
           ssh-keyscan -p "${DEPLOY_PORT:-22}" -T 5 -t ed25519,rsa \