chore(ci): persist deployed SHA into .env after deploy

The deploy job exports MANGALORD_TAG in-shell only, so .env kept its
`latest` placeholder and the live SHA was only visible via docker inspect.
sed the built SHA into .env after a successful `up -d` (non-fatal) so .env
reflects what's actually deployed and manual `docker compose up` is
deterministic.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -149,5 +149,12 @@ jobs:
           export MANGALORD_TAG="$IMAGE_TAG"
           docker compose pull mangalord-backend mangalord-frontend
           docker compose up -d mangalord-backend mangalord-frontend
+          # Persist the deployed SHA into .env so it reflects what's actually
+          # live. The export above is shell-only; without this, .env keeps its
+          # `latest` placeholder and `docker inspect` is the only way to see the
+          # running SHA. Runs only after a successful `up -d` (set -eu); kept
+          # non-fatal so a write hiccup can't fail an otherwise-good deploy.
+          sed -i "s/^MANGALORD_TAG=.*/MANGALORD_TAG=${IMAGE_TAG}/" .env \
+            || echo "::warning::could not persist MANGALORD_TAG to .env"
           docker image prune -f
           docker logout "$REGISTRY_URL"