feat: harden server pull deployments and git hygiene

src/main/ipc.cjs

@@ -859,6 +859,8 @@ function registerIpc({
       "align-origin",
       "configure-local-safety",
       "add-gitignore",
+      "add-gitattributes",
+      "add-editorconfig",
       "protect-default-branch",
     ]);
     if (!allowed.has(check?.fixAction))
@@ -1121,6 +1123,20 @@ function registerIpc({
       return unraid.preflight({ repository: current, profileId });
     return preflight.runDeployment({ repository: current, profileId });
   });
+  register("deployment:repair-write-access", async ({ repository, profileId }) => {
+    const current = await resolveRepository(repository);
+    const profile = store.getDeploymentProfile(current.fullName, profileId);
+    if (profile?.provider !== "ssh-unraid")
+      throw new Error("Write-access repair is available only for SSH / Unraid deployment profiles.");
+    const result = await unraid.repairWriteAccess({ repository: current, profileId });
+    await audit.append("deployment.write-access.repaired", {
+      repository: current.fullName,
+      profileId,
+      changed: result.changed,
+      remotePath: result.after?.remotePath || result.before?.remotePath || null,
+    });
+    return result;
+  });
   register(
     "deployment:dispatch",
     async ({
@@ -1176,7 +1192,7 @@ function registerIpc({
     },
   );
   register("deployment:health", ({ url }) => deployments.checkHealth(url));
-  register("deployment:link-server-workload", async ({ repository, serverId, workloadId, deploymentMode = "push-bundle", remoteFolder = "" }) => {
+  register("deployment:link-server-workload", async ({ repository, serverId, workloadId, deploymentMode = "server-git", remoteFolder = "" }) => {
     const current = await resolveRepository(repository);
     const result = await unraid.linkServerWorkload({
       repository: current,
@@ -1187,6 +1203,17 @@ function registerIpc({
     });
     return { ...result, state: store.getPublicState() };
   });
+  register("deployment:configure-server-git-access", async ({ repository, profileId }) => {
+    const current = await resolveRepository(repository);
+    const result = await unraid.configureServerGitAccess({ repository: current, profileId });
+    await audit.append("deployment.server-git-access-configured", {
+      repository: current.fullName,
+      profileId,
+      keyFingerprint: result.keyFingerprint,
+      hostFingerprint: result.hostFingerprint,
+    });
+    return { ...result, state: store.getPublicState() };
+  });
   register("deployment:discover-server-workloads", async () => {
     const repositoryList = await repositories.refresh();
     const remoteRepositories = repositoryList.filter(