Deploy to a DigitalOcean droplet: wizwar is on the internet

Production shape: one Node process serves the built client and the
websocket on a single port (SPA fallback, same-origin wss in the
client), with Caddy terminating auto-TLS in front. The droplet
(nyc3, $6/mo) runs it under systemd as an unprivileged user with room
files on the persistent disk at /var/lib/wizwar/rooms — deploys and
reboots cannot eat a game. deploy/ carries the one-time droplet setup
script, the systemd unit, the Caddyfile, an everyday deploy script
(build locally, rsync, install, restart), and a README. Live at
https://wizwar.104.236.96.198.sslip.io via sslip.io, so TLS needed no
DNS setup at all. Verified over the real internet: room created,
second player joined, expansion game started, hands dealt, room file
persisted. Fixed en route: rsync's unanchored "data" exclude was
stripping the engine's card database, and tsx must ship (it is the
runtime).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/deploy.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Build locally, push to the droplet, restart. Usage: deploy/deploy.sh <droplet-ip>
+set -euo pipefail
+HOST="${1:?usage: deploy.sh <droplet-ip-or-host>}"
+
+npm run build --workspace=@wizwar/web
+rsync -az --delete \
+  --exclude node_modules --exclude /data --exclude .git --exclude research \
+  ./ "root@$HOST:/opt/wizwar/"
+ssh "root@$HOST" '
+  cd /opt/wizwar && npm install --no-audit --no-fund
+  chown -R wizwar:wizwar /opt/wizwar
+  cp /opt/wizwar/deploy/wizwar.service /etc/systemd/system/wizwar.service
+  systemctl daemon-reload
+  systemctl enable --now wizwar
+  systemctl restart wizwar
+  systemctl --no-pager -l status wizwar | head -5
+'
+echo "deployed."