fix(ci): use git reset --hard for deploy and remove orphan containers

- git pull fails when deploy.sh has modified tracked files (sed on nginx.conf)
- git reset --hard origin/main is safe since .env/credentials are untracked
- --remove-orphans cleans up old Docker nginx/certbot containers

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ImTotem

.github/workflows/ci-cd.yml

@@ -86,5 +86,6 @@ jobs:
           port: ${{ secrets.SERVER_PORT }}
           script: |
             cd ~/BCSD_API
-            git pull origin main
+            git fetch origin main
+            git reset --hard origin/main
             bash infra/scripts/deploy.sh

infra/scripts/deploy.sh

@@ -64,7 +64,7 @@ echo "1. Building $NEXT..."
 $COMPOSE build "api-${NEXT}"
 
 echo "2. Starting $NEXT..."
-$COMPOSE up -d "api-${NEXT}"
+$COMPOSE up -d --remove-orphans "api-${NEXT}"
 
 echo "3. Health check on api-${NEXT}..."
 if ! health_check "$NEXT"; then