[WIP] Add GitHub Actions workflow for DigitalOcean deployment (#2)

* Initial plan

* Add GitHub Actions deploy workflow and CI/CD docs

Co-authored-by: rsantamaria01 <50458018+rsantamaria01@users.noreply.github.com>
Agent-Logs-Url: https://github.com/rsantamaria01/arrs-media-server/sessions/10e98709-7854-4901-bc2b-7f8aec7b6c3d

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: rsantamaria01 <50458018+rsantamaria01@users.noreply.github.com>

Author: Copilot

.github/workflows/deploy.yml

@@ -0,0 +1,25 @@
+name: Deploy to DigitalOcean
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    permissions: {}
+
+    steps:
+      - name: Deploy via SSH
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ secrets.DO_HOST }}
+          username: ${{ secrets.DO_USER }}
+          password: ${{ secrets.DO_PASSWORD }}
+          script: |
+            cd /opt/mediastack
+            git pull origin main
+            mkdir -p services/{prowlarr,sonarr,sonarr-anime,radarr,lidarr,readarr,bazarr,jellyfin,npm/data,npm/letsencrypt}
+            docker compose pull
+            docker compose up -d --remove-orphans

README.md

@@ -57,3 +57,27 @@ A production-ready, self-hosted media automation stack built with Docker Compose
 | Bazarr              | Automatic subtitle manager (EN + ES)         | 6767           |
 | Jellyfin            | Media streaming server                       | 8096           |
 | Nginx Proxy Manager | Reverse proxy with SSL termination           | 80, 443, 81    |
+
+## CI/CD
+
+Every push to the `main` branch automatically deploys to the DigitalOcean droplet via GitHub Actions (see `.github/workflows/deploy.yml`).
+
+### Required GitHub Secrets
+
+Add the following secrets in your repository under **Settings → Secrets and variables → Actions**:
+
+| Secret        | Description                        |
+|---------------|------------------------------------|
+| `DO_HOST`     | Droplet IP address                 |
+| `DO_USER`     | SSH username                       |
+| `DO_PASSWORD` | SSH password                       |
+
+### Environment File
+
+The `.env` file is **not** committed to the repository. It must be created manually on the droplet before the first deployment:
+
+```bash
+# On the droplet
+cp /opt/mediastack/.env.example /opt/mediastack/.env
+# Then edit /opt/mediastack/.env to set PUID, PGID, TZ, etc.
+```