feat(tooling): add update-all.sh post-pull orchestrator; deploy skill uses it

update-all.sh is the single source of truth for the on-host post-pull build +
restart steps: render drasl/nmsr configs, sync server mods, regen the landing
mod list, rebuild www/, then apply via docker compose. Two modes:
- default (rolling): up -d --build, then restart ONLY services whose mounted
  inputs changed since a pre-run snapshot — drasl/nmsr on a config re-render,
  minecraft on a mod change. Minimal downtime. (Cannot detect caddy static-conf
  changes — use --hard for those.)
- --hard: down --remove-orphans && up -d --build (full restart, MC downtime).

Strict halt on any error; landing build sources nvm + pnpm (never npm) and bakes
.env. fetch-authlib stays out (rarely changes) — the deploy skill runs it before
update-all. Refactor the deploy skill to `pull && fetch-authlib && update-all.sh
--hard` so the step list can't drift.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/skills/deploy/SKILL.md

@@ -31,38 +31,32 @@ invoking this skill is the authorization to proceed, but:
    already up to date and ask whether to restart anyway (they may want a plain
    restart). If `git fetch` fails (host unreachable, auth), STOP and report.
 
-2. **Pull + hard restart** (single SSH session, halts on any error):
+2. **Pull, ensure authlib, then `update-all.sh --hard`** (single SSH session,
+   halts on any error):
    ```bash
    ssh cochi 'set -e
      cd /home/ubuntu/mc/ulicraft-server-v1
      git pull --ff-only
-     tooling/render-config.sh
      tooling/fetch-authlib.sh
-     docker compose down --remove-orphans
-     docker compose up -d --build'
+     ./update-all.sh --hard'
    ```
    - `--ff-only` refuses to merge — if the pull is not a fast-forward, STOP and
      report (local changes on the host need manual resolution).
-   - `render-config.sh` re-renders drasl/nmsr/packwiz configs from `.env`
-     (needs `.env` complete: `BASE_DOMAIN`, `RCON_PASSWORD`,
-     `DISTRIBUTION_WEB_ROOT`, `CADDY_HTTP_*`, `REGISTRATION_MODE`). It halts on
-     an invalid `REGISTRATION_MODE` (must be `invite` or `open`).
    - `fetch-authlib.sh` ensures `runtime/authlib-injector.jar` exists (gitignored;
-     skips if already valid). Missing jar = minecraft crashloops with "Error
-     opening zip file or JAR manifest missing".
-
-2b. **Landing rebuild (only if needed).** The static site `www/` is gitignored —
-   `git pull` does NOT update it. If the pulled commits (from the step-1
-   pre-check) touch `landing/`, or `REGISTRATION_MODE` changed, rebuild it;
-   otherwise skip:
-   ```bash
-   ssh cochi 'set -e
-     cd /home/ubuntu/mc/ulicraft-server-v1
-     cd landing && set -a && . ../.env && set +a && pnpm run build'
-   ```
-   Sourcing `.env` bakes `BASE_DOMAIN` + `REGISTRATION_MODE` (invite-field on/off)
-   into the output. A flag-only change just needs this rebuild + a `drasl`
-   restart (already covered by step 2's `up`), not the world downtime.
+     skips if already valid; NOT part of update-all since it rarely changes).
+     Missing jar = minecraft crashloops with "Error opening zip file or JAR
+     manifest missing". Run it before `update-all` so the jar is present when
+     compose brings minecraft up.
+   - **`update-all.sh` is the single source of truth** for the post-pull build +
+     restart steps (render drasl/nmsr configs from `.env`, sync server mods, regen
+     the landing mod list, rebuild `www/`, then apply via docker compose). It is
+     also runnable on its own for a lighter rolling update (no `--hard` =
+     change-detected restart, no world downtime). `--hard` here does
+     `down --remove-orphans && up -d --build` for the deliberate full restart.
+     `render-config.sh` halts on an invalid `REGISTRATION_MODE` (must be `invite`
+     or `open`); a missing distribution jar halts `sync-server-mods.sh`. The
+     landing rebuild is unconditional (the gitignored `www/` is never updated by
+     `git pull`), so no separate landing step is needed.
 
 3. **Verify.**
    ```bash