fix(pipeline): sync bootstrap stack files before guard, not after

.woodpecker.yml

@@ -215,13 +215,7 @@ steps:
 
         for STACK in $ALL_STACKS; do
           echo "--- Deploying: $STACK ---"
-          case "$STACK" in
-            traefik|woodpecker|postgresql)
-              echo "  [BOOTSTRAP] $STACK: secrets provisioned, deploy is MANUAL."
-              echo "  Run: bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK"
-              continue ;;
-          esac
-          # Sync flat file or entire folder
+          # Sync files to host first (always, even for bootstrap stacks)
           if [ -d "$STACK" ]; then
             rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
               "$STACK/" root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/$STACK/
@@ -229,6 +223,16 @@ steps:
             rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
               "${STACK}.yaml" root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/
           fi
+
+          # Bootstrap-tier guard: file synced to host, deploy is MANUAL
+          case "$STACK" in
+            traefik|woodpecker|postgresql)
+              echo "  [BOOTSTRAP] $STACK: file synced. Deploy is MANUAL."
+              echo "  Run: bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK"
+              continue ;;
+          esac
+
+          # Tier 2: auto-deploy
           ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} \
             "bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK" \
             && echo "  OK $STACK" || { echo "  FAIL $STACK"; exit 1; }