fix deploy race condition and harden security

- reorder app.sh to run cert before commit/push (fixes workflow failure on first run)
- quote $SSH_ORIGINAL_COMMAND in authorized_keys to prevent command injection
- add port validation in service.sh nginx command
- pin host key in deploy-beszel.yml workflow
- fix append vs overwrite for known_hosts in deploy-nginx.yml

tools/app.sh

@@ -529,6 +529,7 @@ cmd_monitor() {
 cmd_all() {
     cmd_dns
     cmd_repo
+    cmd_cert
     cmd_files
 
     echo "==> Committing and pushing hantim-server..."
@@ -541,7 +542,6 @@ cmd_all() {
         git push
     fi
 
-    cmd_cert
     cmd_garage
     cmd_build
     cmd_verify

tools/service.sh

@@ -256,6 +256,11 @@ cmd_nginx() {
     local port="$2"
     local fqdn="$name.hantim.net"
 
+    if ! [[ "$port" =~ ^[0-9]+$ ]]; then
+        echo "Error: port must be a number."
+        exit 1
+    fi
+
     if [ -e "$REPO_ROOT/docker/nginx/conf.d/$fqdn.conf" ]; then
         echo "  docker/nginx/conf.d/$fqdn.conf already exists, skipping."
         return