fix: add secrets validation and harden deploy workflow - #3

The "Deploy to VPS" job was failing immediately with Error: missing server host because VPS_HOST, VPS_USER, and VPS_SSH_KEY secrets were not configured — ${{ secrets.XXX }} silently resolves to empty strings, giving the SSH action no connection parameters.

There was also a secondary bug: cd ${{ secrets.VPS_APP_DIR }} collapses to bare cd when the secret is unset, silently navigating to $HOME instead of the app directory.

Changes

• Added "Validate required secrets" step — checks VPS_HOST, VPS_USER, VPS_SSH_KEY via env vars before attempting SSH; emits a ::error:: annotation listing missing secrets and fails fast with an actionable message instead of a cryptic SSH error.
• Removed VPS_APP_DIR secret dependency — replaced with the hardcoded path ~/apps/eventshare documented in DEPLOYMENT_STEPS.md. This value is not secret; making it a secret only introduced a silent failure mode.

- name: Validate required secrets
  run: |
    missing=()
    [[ -z "$VPS_HOST" ]]    && missing+=(VPS_HOST)
    [[ -z "$VPS_USER" ]]    && missing+=(VPS_USER)
    [[ -z "$VPS_SSH_KEY" ]] && missing+=(VPS_SSH_KEY)
    if [[ ${#missing[@]} -gt 0 ]]; then
      echo "::error::Required secrets are not set: ${missing[*]}"
      echo "Configure them in Settings → Secrets and variables → Actions"
      exit 1
    fi
  env:
    VPS_HOST: ${{ secrets.VPS_HOST }}
    VPS_USER: ${{ secrets.VPS_USER }}
    VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}

Note: The deploy will still fail until VPS_HOST, VPS_USER, and VPS_SSH_KEY are configured under Settings → Secrets and variables → Actions. This PR ensures the failure is loud and actionable rather than opaque.