fix: resolve Hetzner deploy failures — bash syntax error, PM2 start, JWT_SECRET crash loop

.github/workflows/deploy-hetzner.yml

@@ -117,10 +117,12 @@ jobs:
                npm install --legacy-peer-deps --no-audit --no-fund
                if [ -d UNICORN_FINAL ]; then
                  npm install --prefix UNICORN_FINAL --legacy-peer-deps --no-audit --no-fund
+                 npm rebuild better-sqlite3 --prefix UNICORN_FINAL 2>/dev/null || true
+               else
+                 npm rebuild better-sqlite3 2>/dev/null || true
                fi
 
                echo '🎨 build frontend…'
-               if [ -d client ] && [ -f client/package.json ]; then
                if [ -d UNICORN_FINAL/client ]; then
                  cd UNICORN_FINAL/client
                  npm install --legacy-peer-deps --no-audit --no-fund
@@ -130,13 +132,10 @@ jobs:
                  cd client
                  npm install --legacy-peer-deps --no-audit --no-fund
                  npm run build
-                 cd "\$DEPLOY_PATH"
+                 cd ..
                fi
 
                echo '🧪 local lint + tests…'
-               cd "\$DEPLOY_PATH"
-               npm run lint
-               npm test
                if [ -d UNICORN_FINAL ]; then
                  npm --prefix UNICORN_FINAL run lint
                  npm --prefix UNICORN_FINAL test
@@ -147,25 +146,38 @@ jobs:
 
                echo '♻️  pm2 restart…'
                if command -v pm2 >/dev/null 2>&1; then
-                 pm2 startOrRestart ecosystem.config.js
+                 pm2 stop all 2>/dev/null || true
+                 pm2 delete all 2>/dev/null || true
+                 if [ -f UNICORN_FINAL/ecosystem.config.js ]; then
+                   pm2 start UNICORN_FINAL/ecosystem.config.js
+                 elif [ -f ecosystem.config.js ]; then
+                   pm2 start ecosystem.config.js
+                 fi
                  pm2 save
-                 echo '✅ PM2 restarted'
+                 echo '✅ PM2 started'
                else
                  systemctl restart unicorn 2>/dev/null && echo '✅ systemctl restart ok' || echo '⚠️  pm2/systemctl not found'
                fi
 
                trap - ERR
                echo '🛠️  Running server auto-repair (nginx/firewall/ssl)…'
-               if [ -f scripts/fix-server.sh ]; then
+               if [ -f UNICORN_FINAL/scripts/fix-server.sh ]; then
+                 chmod +x UNICORN_FINAL/scripts/fix-server.sh || true
+                 bash UNICORN_FINAL/scripts/fix-server.sh "\$DEPLOY_PATH/UNICORN_FINAL" "${DOMAIN}" || true
+               elif [ -f scripts/fix-server.sh ]; then
                  chmod +x scripts/fix-server.sh || true
                  bash scripts/fix-server.sh "\$DEPLOY_PATH" "${DOMAIN}" || true
                else
                  echo '⚠️  scripts/fix-server.sh missing — skipping extended repair'
                fi
 
-               sleep 5
+               sleep 15
                HEALTH=\$(curl -s http://localhost:3000/api/health 2>/dev/null || echo '{\"status\":\"unreachable\"}')
                echo \"🩺 Health: \$HEALTH\"
+               if echo \"\$HEALTH\" | grep -q '\"unreachable\"'; then
+                 echo '⚠️  Backend unreachable — showing PM2 logs:'
+                 pm2 logs unicorn --lines 30 --nostream 2>/dev/null || true
+               fi
                curl -sf http://localhost:3000/api/quantum-integrity/status >/dev/null && echo '🛡️ Quantum Integrity API: OK' || echo '⚠️ Quantum Integrity API: check manually'
                curl -kfsS --resolve "${DOMAIN}:443:127.0.0.1" "https://${DOMAIN}/health" >/dev/null 2>&1 && echo '🔒 HTTPS local check: OK' || echo '⚠️  HTTPS local check: FAILED'
               "

UNICORN_FINAL/scripts/fix-server.sh

@@ -283,12 +283,16 @@ else
     warn "node_modules lipsesc. Se instalează dependențele..."
     cd "$DEPLOY_PATH"
     npm install --production
+    npm rebuild better-sqlite3 2>/dev/null || true
     fixed "Dependențe npm instalate"
   else
     ok "node_modules există"
+    # Rebuild native modules to match current Node.js ABI
+    cd "$DEPLOY_PATH"
+    npm rebuild better-sqlite3 2>/dev/null || true
   fi
 
-  # 3e. Creare .env dacă lipsește
+  # 3e. Creare .env dacă lipsește sau JWT_SECRET invalid
   if [ ! -f "$DEPLOY_PATH/.env" ]; then
     warn ".env lipsește. Se creează cu setări minimale..."
     JWT_SECRET=$(node -e "console.log(require('crypto').randomBytes(32).toString('hex'))" 2>/dev/null || openssl rand -hex 32)
@@ -305,6 +309,17 @@ ENVFILE
       echo "PORT=${NODE_PORT}" >> "$DEPLOY_PATH/.env"
       fixed "PORT=${NODE_PORT} adăugat în .env"
     fi
+    # Asigură că JWT_SECRET este setat și valid (nu valoarea implicită)
+    EXISTING_JWT=$(grep '^JWT_SECRET=' "$DEPLOY_PATH/.env" | cut -d= -f2- | tr -d '"' | tr -d "'" | head -1)
+    if [ -z "$EXISTING_JWT" ] || [ "$EXISTING_JWT" = "unicorn-jwt-secret-change-in-prod" ]; then
+      NEW_JWT=$(node -e "console.log(require('crypto').randomBytes(32).toString('hex'))" 2>/dev/null || openssl rand -hex 32)
+      if grep -q '^JWT_SECRET=' "$DEPLOY_PATH/.env"; then
+        sed -i "s|^JWT_SECRET=.*|JWT_SECRET=${NEW_JWT}|" "$DEPLOY_PATH/.env"
+      else
+        echo "JWT_SECRET=${NEW_JWT}" >> "$DEPLOY_PATH/.env"
+      fi
+      fixed "JWT_SECRET generat și salvat în .env"
+    fi
   fi
 
   # 3f. Verificare dacă portul 3000 este ocupat
@@ -339,9 +354,15 @@ ENVFILE
       pm2 delete all 2>/dev/null || true
 
       if [ -f "$DEPLOY_PATH/ecosystem.config.js" ]; then
+        cd "$DEPLOY_PATH"
         pm2 start ecosystem.config.js
         fixed "PM2 pornit din ecosystem.config.js"
+      elif [ -f "$DEPLOY_PATH/UNICORN_FINAL/ecosystem.config.js" ]; then
+        cd "$DEPLOY_PATH/UNICORN_FINAL"
+        pm2 start ecosystem.config.js
+        fixed "PM2 pornit din UNICORN_FINAL/ecosystem.config.js"
       elif [ -f "$DEPLOY_PATH/backend/index.js" ]; then
+        cd "$DEPLOY_PATH"
         pm2 start backend/index.js \
           --name unicorn-backend \
           --env production \
@@ -365,7 +386,7 @@ ENVFILE
 fi
 
 # 3h. Verificare finală port 3000
-sleep 3
+sleep 10
 PORT_CHECK=0
 if ss -tlnp 2>/dev/null | grep -q ":${NODE_PORT}[[:space:]]"; then
   PORT_CHECK=1
@@ -378,6 +399,8 @@ if [ "$PORT_CHECK" -eq 1 ]; then
 else
   ko "Backend NU ascultă pe portul ${NODE_PORT}"
   warn "Verifică manual: pm2 logs && pm2 list"
+  # Afișează ultimele loguri PM2 pentru diagnosticare
+  pm2 logs unicorn --lines 30 --nostream 2>/dev/null || true
 fi
 
 # 3i. Test health endpoint