Re-add the deploy job dropped during open-source cleanup. The job pulls
the just-built image and restarts the compose stack in vars.DEPLOY_PATH.
The gate `if: vars.DEPLOY_PATH != ''` keeps the workflow safe for
public mirroring: no path appears in the YAML, and any fork without
DEPLOY_PATH set will silently skip the deploy step.
Add Jwt__Algorithm config to choose between HS256 (shared symmetric key,
existing behavior, default) and RS256 (Authority-based OIDC discovery,
public-key auto-fetch with periodic refresh).
RS256 mode makes the server compatible with any standard OAuth 2.1 / OIDC
provider (Logto, ZITADEL, Keycloak, Auth0) without requiring a shared
secret. HS256 mode remains the default for minimal self-built AS setups.
zhengchen.tao