The admin CLI moves a persona to another login and deletes a login; the deploy no longer signs in

The owner took @thepra, which the deploy had made and kept under its own login deploy-smoke for its signed-in check, for
the administrator's login (owner decision 2026-10-17). No persona could change login, so:
- admin move-persona <persona> <root> re-points the persona's link first, so the old login can no longer exchange a token
  for it, then ends its Mastodon tokens and authorizations. Its actor, posts and followers stay; nobody outside is told,
  since nothing they hold changes.
- admin delete-root <root> deletes a login as the client deletes its own (RootRemoval): every persona it still has goes
  with it, announced deleted, and its sessions end.
- admin smoke and the deploy's signed-in step are gone, since the step would make deploy-smoke again and fail to make
  @thepra under it. The deploy keeps its anonymous checks; tools/smoke/oauth.sh stays for the pasture's privapub_token.

Tests: move-persona (the persona listed under its new login only, its old token refused, unknown persona or login exit 1)
and delete-root (the login and its persona deleted, the login refused); the whole suite passes (963).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -128,22 +128,8 @@ jobs:
             || { echo "::error::/stargazing does not say the crawler is on"; exit 1; }
           echo "::notice::serving $served"
 
-      # @thepra is the deploy's own persona (owner decision, 2026-10-04): the server's CLI makes or keeps it, undiscoverable,
-      # and gives its root a new password on every deploy, so no secret is stored and nobody has to create anything.
-      - name: Sign in as @thepra and check the signed-in API
-        run: |
-          creds=$(cd "$WEB_ROOT" && ASPNETCORE_ENVIRONMENT=Production ./PrivaPub admin smoke thepra | grep -E '^deploy-smoke [^ ]+$' | tail -1)
-          [ -n "$creds" ] || { echo "::error::the smoke persona could not be prepared"; exit 1; }
-          read -r login password <<< "$creds"
-          echo "::add-mask::$password"
-          read -r token cid cs <<< "$(tools/smoke/oauth.sh "$PUBLIC_URL" "$login" "$password" thepra read)"
-          echo "::add-mask::$token"
-          tools/smoke/mastodon-api.sh "$PUBLIC_URL" "$token"
-          discoverable=$(curl -fsS -H "Authorization: Bearer $token" "$PUBLIC_URL/api/v1/accounts/verify_credentials" | python3 -c "import json,sys; print(json.load(sys.stdin).get('discoverable'))")
-          [ "$discoverable" = "False" ] || { echo "::error::@thepra is discoverable"; exit 1; }
-          curl -fsS -o /dev/null -X POST "$PUBLIC_URL/oauth/revoke" --data-urlencode "token=$token" \
-            --data-urlencode "client_id=$cid" --data-urlencode "client_secret=$cs"
-          echo "::notice::signed in as @thepra"
+      # The deploy no longer signs in (owner decision 2026-10-17): it kept a login of its own, deploy-smoke, whose @thepra
+      # is the administrator's now. Its checks are the anonymous ones above.
 
       # The server fetches DB-IP Lite itself (GeoUpdater) about 30 s after it starts and then daily; the deploy only checks.
       - name: Geolocation databases are current