merge dispatch and deploy into a single deploy.sh

deploy.sh reads SSH_ORIGINAL_COMMAND directly, validates it, and
runs the deploy. No more dispatch indirection.

README.md

@@ -11,8 +11,7 @@ docker/              # One directory per app, each with a compose.yml
   nginx/             # Nginx Proxy Manager (reverse proxy + TLS)
   timothykim.net/    # timothykim.net static site
 scripts/
-  deploy-dispatch.sh # SSH command dispatcher (validates and routes deploy commands)
-  deploy.sh          # Generic deploy script (git pull + docker compose up)
+  deploy.sh          # Deploy script (validates command, git pull, docker compose up)
   new-app.sh         # Scaffolding script to add a new app
 setup.sh             # One-time server provisioning script
 .gitea/workflows/    # Per-app deploy workflows triggered by path changes
@@ -47,10 +46,10 @@ Each app has two components:
 1. **Gitea Actions workflow** (`.gitea/workflows/deploy-<app>.yml`) -- triggers
    on pushes to `main` when files under `docker/<app>/` change. SSHes into the
    server as the `deploy` user to trigger the deploy.
-2. **SSH dispatcher** (`scripts/deploy-dispatch.sh`) -- the `deploy` user's
+2. **Deploy script** (`scripts/deploy.sh`) -- the `deploy` user's
    `authorized_keys` is locked to this script via a `command=` directive. It
-   validates the command and runs `scripts/deploy.sh`, which pulls the latest
-   repo changes and runs `docker compose pull && up -d` for that app.
+   validates the command, pulls the latest repo changes, and runs
+   `docker compose pull && up -d` for that app.
 
 This means: