feat(api): real /api/publish endpoint with GitHub workflow_dispatch

[Delqhi]

Summary

Replaces the simulated Publish button (setTimeout → deployed) with a real network request to POST /api/publish that triggers the GitHub Actions docker.yml workflow via workflow_dispatch.

Changes

• app/api/publish/route.ts — New POST-only endpoint. Validates GITHUB_REPO + GITHUB_TOKEN env vars, calls GitHub REST API to dispatch docker.yml, handles 401/429 with Retry-After, returns 202 on success. All non-POST methods return 405.
• components/publish-menu.tsx — Replaced window.setTimeout with fetch("/api/publish"). Added error state with real error message display. Button now shows "Retry" on error.
• .env.example — Added GITHUB_REPO and GITHUB_TOKEN placeholders with documentation.

Deployment strategy

Option C from #39: GitHub workflow_dispatch trigger.

• Least infra coupling — no Docker socket mount, no extra services
• Uses existing GITHUB_TOKEN (needs workflow scope)
• The VPS pulls the new image and restarts after the workflow completes
• The docker.yml workflow already supports workflow_dispatch on line 13

Request / Response shape

Request:

POST /api/publish
{
  "chatId": "abc123",
  "visibility": "private"
}

Success (202):

{
  "status": "dispatched",
  "message": "Deploy workflow triggered for OpenSIN-Code/SIN-Code-WebUI-v2. Check GitHub Actions for progress.",
  "repo": "OpenSIN-Code/SIN-Code-WebUI-v2",
  "chatId": "abc123",
  "visibility": "private"
}

Error (503 — not configured):

{
  "status": "error",
  "message": "Publish is not configured. Set GITHUB_REPO and GITHUB_TOKEN in .env."
}

User configuration

Set in .env (or .env.development.local.md):

GITHUB_REPO=OpenSIN-Code/SIN-Code-WebUI-v2
GITHUB_TOKEN=ghp_...  (needs "workflow" scope)

Verification

• pnpm tsc --noEmit → exit 0
• pnpm build → success
• /api/publish appears as dynamic route in build output
• Secret scan on diff → 0 hits

Closes #39

[github-actions]

CEO Audit — Not applicable

This repository is a Node.js / TypeScript project.
The CEO Audit is a Python tool; running it on a non-Python
repo would produce a misleading grade.

Recommended checks for this repo:

• pnpm tsc --noEmit (type safety)
• pnpm lint (style)
• pnpm test (unit tests, when added)