fix: CI/CD add missing VITE_OAUTH vars + pm2 reload via tetardtek-brain

VITE_OAUTH_URL and VITE_OAUTH_CLIENT_ID were missing from build env,
causing empty client_id in PKCE flow. pm2 reload via su - tetardtek-brain
(same pattern as SuperOAuth post ssh-hardening).

.gitea/workflows/deploy.yml

@@ -32,8 +32,7 @@ jobs:
       - name: Restart pm2
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
-          pm2 restart originsdigital-backend || pm2 start /var/www/originsdigital/backend/dist/index.js --name originsdigital-backend
-          pm2 save
+          su - tetardtek-brain -c 'pm2 reload originsdigital-backend --update-env'
 
       # ── Frontend ─────────────────────────────────────────────────────────────
       - name: Install & build frontend
@@ -41,6 +40,8 @@ jobs:
         env:
           VITE_API_URL: ${{ secrets.VITE_API_URL }}
           VITE_SUPEROAUTH_URL: ${{ secrets.VITE_SUPEROAUTH_URL }}
+          VITE_OAUTH_URL: ${{ secrets.VITE_SUPEROAUTH_URL }}
+          VITE_OAUTH_CLIENT_ID: origins
         run: |
           npm ci
           npm run build