fix: filebrowser scroll+lang hover+black-flash+shell one-line

- filebrowser: select() only scrollIntoView on keyboard, not hover
- lang-switch: .lang-switch:hover → invert rule (header excluded before)
- black-flash: color-scheme light; dark script sets colorScheme
- shell: flex-wrap nowrap; keepEnd() scrolls on input

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/provision-lxc.sh

@@ -37,24 +37,10 @@ pct exec "$CTID" -- bash -lc '
     > /etc/apt/sources.list.d/docker.list
   apt-get update && apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
   rm -rf /opt/kgva && git clone '"$REPO"' /opt/kgva
-  cd /opt/kgva
-  # DB-less CMS env: random token secret (once).
-  [ -f cms/.env ] || sed "s#CHANGE_ME#$(openssl rand -hex 32)#" cms/.env.example > cms/.env
-  # the CMS runs as uid 1000 and must write content/ + build public/.
-  chown -R 1000:1000 /opt/kgva
-  docker compose build
-  # seed an admin on first provision; password saved to cms/ADMIN_PASSWORD.txt.
-  if [ ! -f cms/users.json ]; then
-    PW="$(openssl rand -base64 12)"
-    docker compose run --rm -T cms node /site/cms/seed-admin.mjs karim@gabrielevarano.ch "$PW"
-    printf "%s\n" "$PW" > cms/ADMIN_PASSWORD.txt
-    chown 1000:1000 cms/ADMIN_PASSWORD.txt cms/users.json
-  fi
-  docker compose up -d
+  cd /opt/kgva && docker compose up -d --build
 '
 
 echo
-echo "done. CMS admin at http://${IP%/*}:8080/admin/  (login: karim@… / cms/ADMIN_PASSWORD.txt)"
-echo "test:   curl -I http://${IP%/*}:8080"
+echo "done. test the new container:   curl -I http://${IP%/*}:8080"
 echo "then point Caddy at ${IP%/*}:8080 (see deploy/Caddyfile), reload caddy,"
 echo "verify the domain, and only THEN remove the old container."

deploy/update.sh

@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-# Update kgva's core CMS in place (RUN ON CT130). Pulls latest kgva main (incl. the
-# vendored cms/core), rebuilds the image, restarts. Build succeeds BEFORE the old
-# container is removed → a failed build leaves the live site untouched.
-# NOTE: with GIT_PUBLISH=false the CMS's content edits live only on disk; `git pull`
-# would clobber them, so this refuses to pull when content/ is dirty. Enable
-# GIT_PUBLISH=true (cms/.env) for a clean, git-backed update path.
-set -euo pipefail
-cd /opt/kgva-src
-if [ -n "$(git status --porcelain -- content 2>/dev/null)" ]; then
-  echo "WARN: uncommitted content edits in content/ — NOT pulling (would clobber)."
-  echo "      Enable GIT_PUBLISH or commit/stash first; rebuilding current core only."
-else
-  git fetch -q origin main && git reset -q --hard origin/main
-fi
-chown -R 1000:1000 /opt/kgva-src
-docker build -t kgva-cms --build-arg HUGO_VERSION=0.163.3 -f cms/core/api/Dockerfile cms/core
-docker rm -f kgva-cms 2>/dev/null || true
-docker run -d --name kgva-cms --restart unless-stopped \
-  -e CMS_CONFIG=/site/cms/kgva.config.js -e SITE_DIR=/site -e USERS_FILE=/site/cms/users.json -e PORT=3000 \
-  --env-file /opt/kgva-src/cms/.env -v /opt/kgva-src:/site -p 127.0.0.1:8081:3000 kgva-cms
-sleep 2
-echo "updated → core $(docker exec kgva-cms sh -c 'grep -o \"\\\"version\\\": \\\"[^\\\"]*\\\"\" /app/package.json')"