fix deploy race condition and harden security

- reorder app.sh to run cert before commit/push (fixes workflow failure on first run)
- quote $SSH_ORIGINAL_COMMAND in authorized_keys to prevent command injection
- add port validation in service.sh nginx command
- pin host key in deploy-beszel.yml workflow
- fix append vs overwrite for known_hosts in deploy-nginx.yml

tools/service.sh

@@ -256,6 +256,11 @@ cmd_nginx() {
     local port="$2"
     local fqdn="$name.hantim.net"
 
+    if ! [[ "$port" =~ ^[0-9]+$ ]]; then
+        echo "Error: port must be a number."
+        exit 1
+    fi
+
     if [ -e "$REPO_ROOT/docker/nginx/conf.d/$fqdn.conf" ]; then
         echo "  docker/nginx/conf.d/$fqdn.conf already exists, skipping."
         return