Adds a deploy job to the existing build-and-push workflow: SSHes into the deploy host as a dedicated espressoframeuser account and runs docker compose pull && up -d. Runs only after build-and-push succeeds, using a key/host pulled from repo secrets (DEPLOY_SSH_KEY, DEPLOY_HOST, optional DEPLOY_PORT).