Deployment updates

docs/ops/cd-deploy-ssh-setup.md

@@ -23,11 +23,21 @@ The private key does **not** need to live on the VM. The VM only needs the publi
 
 ### 1. On your computer — create the key pair
 
+**Windows (PowerShell):**
+
+```powershell
+ssh-keygen -t ed25519 -f vigilcare-deploy -N '""' -C "gitea-cd"
+```
+
+Windows 10/11 ships the OpenSSH client by default (`Settings → Optional features → OpenSSH Client` if it's missing). PowerShell needs the empty passphrase quoted as `'""'` — a bare `-N ""` sometimes gets swallowed by PowerShell's argument parsing and prompts for a passphrase anyway.
+
+**Linux (Ubuntu):**
+
 ```bash
 ssh-keygen -t ed25519 -f vigilcare-deploy -N "" -C "gitea-cd"
 ```
 
-That creates two files in the current folder:
+Both produce two files in the current folder:
 
 - `vigilcare-deploy` — **private** (secret)
 - `vigilcare-deploy.pub` — **public** (safe to copy)
@@ -49,6 +59,14 @@ chmod 600 ~/.ssh/authorized_keys
 
 Or from your computer (if you already have another way to SSH in):
 
+**Windows (PowerShell):** `ssh-copy-id` doesn't exist on Windows, so pipe the public key into the same `mkdir`/`echo`/`chmod` sequence over SSH instead:
+
+```powershell
+Get-Content vigilcare-deploy.pub | ssh deploy@YOUR_DEPLOY_HOST "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
+```
+
+**Linux (Ubuntu):**
+
 ```bash
 ssh-copy-id -i vigilcare-deploy.pub deploy@YOUR_DEPLOY_HOST
 ```
@@ -69,15 +87,35 @@ Also set:
 
 ### 4. Sanity check from your computer
 
+**Windows (PowerShell):**
+
+```powershell
+ssh -i vigilcare-deploy deploy@YOUR_DEPLOY_HOST
+```
+
+**Linux (Ubuntu):**
+
 ```bash
 ssh -i vigilcare-deploy deploy@YOUR_DEPLOY_HOST
 ```
 
-If that works without a password, CD’s SSH steps will work the same way (the runner uses the same private key from the secret).
+Same command either way — if that works without a password, CD's SSH steps will work the same way (the runner uses the same private key from the secret).
 
 ### 5. Optional cleanup on your computer
 
-After the private key is in Gitea and you’ve verified SSH, you can delete the local private file if you don’t want another copy. Keep the public key only if you need it again. Prefer regenerating over emailing or sharing the private key.
+After the private key is in Gitea and you've verified SSH, you can delete the local private file if you don't want another copy. Keep the public key only if you need it again. Prefer regenerating over emailing or sharing the private key.
+
+**Windows (PowerShell):**
+
+```powershell
+Remove-Item vigilcare-deploy
+```
+
+**Linux (Ubuntu):**
+
+```bash
+rm vigilcare-deploy
+```
 
 ---