fix: preserve server env files during local deploy

DEPLOYMENT.md

@@ -176,6 +176,12 @@ What it does:
 4. runs the remote deployment script
 5. verifies the health endpoint
 
+Important:
+- the helper preserves server-local env files:
+  - `.env.test`
+  - `.env.prod`
+- those files are not supposed to be replaced from your Mac checkout
+
 Default assumptions:
 - target host: `root@192.168.2.55`
 - target path: `/opt/workdock`

backend/workflows/templates/workflows/developer_handbook.html

@@ -386,6 +386,7 @@ make backup-verify BACKUP_DIR=backups/backup_YYYYmmdd_HHMMSS</code></pre>
     <p>The preferred current test-deployment path is the local helper script from a Mac or another LAN-connected workstation:</p>
     <pre><code>./scripts/deploy_test_from_mac.sh</code></pre>
     <p>This script fast-forwards <code>develop</code>, syncs the repo to the server with <code>rsync</code>, runs the remote deployment, and verifies the health endpoint.</p>
+    <p>The script explicitly preserves server-local env files such as <code>.env.test</code> and <code>.env.prod</code> so deployment does not wipe machine-specific secrets.</p>
     <p>Direct server-side deploy is still available if the code is already on the server:</p>
     <pre><code>cd /opt/workdock
 RUN_DJANGO_CHECK=0 DEPLOY_HEALTH_URL="http://127.0.0.1:8088/healthz/" ./scripts/deploy_stack.sh .env.test docker-compose.prod.yml</code></pre>

scripts/deploy_test_from_mac.sh

@@ -25,6 +25,8 @@ git pull --ff-only origin develop
 
 echo "Syncing repository to ${DEPLOY_HOST}:${DEPLOY_PATH} ..."
 rsync -az --delete \
+  --filter 'P .env.test' \
+  --filter 'P .env.prod' \
   --exclude '.git' \
   --exclude '.github' \
   --exclude '.venv' \