ci: gate web deploy on web paths; decouple convex deploy and sync APP_DIR only when convex/** changes

.github/workflows/ci-cd-web-desktop.yml

@@ -16,6 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       convex: ${{ steps.filter.outputs.convex }}
+      web: ${{ steps.filter.outputs.web }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -26,10 +27,21 @@ jobs:
           filters: |
             convex:
               - 'convex/**'
+            web:
+              - 'src/**'
+              - 'public/**'
+              - 'prisma/**'
+              - 'next.config.ts'
+              - 'package.json'
+              - 'pnpm-lock.yaml'
+              - 'tsconfig.json'
+              - 'middleware.ts'
+              - 'stack.yml'
 
   deploy:
     name: Deploy (VPS Linux)
-    if: ${{ startsWith(github.ref, 'refs/heads/') }}
+    needs: changes
+    if: ${{ startsWith(github.ref, 'refs/heads/') && needs.changes.outputs.web == 'true' }}
     runs-on: [ self-hosted, linux, vps ]
     steps:
       - name: Checkout
@@ -84,12 +96,29 @@ jobs:
 
   convex_deploy:
     name: Deploy Convex functions
-    needs: [deploy, changes]
+    needs: changes
     if: ${{ needs.changes.outputs.convex == 'true' }}
     runs-on: [ self-hosted, linux, vps ]
     env:
       APP_DIR: /srv/apps/sistema
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Sync workspace to APP_DIR (preserving local env)
+        run: |
+          mkdir -p "$APP_DIR"
+          rsync -az --delete \
+            --filter='protect .env' \
+            --filter='protect .env*' \
+            --filter='protect apps/desktop/.env*' \
+            --filter='protect convex/.env*' \
+            --exclude '.git' \
+            --exclude '.next' \
+            --exclude '.env*' \
+            --exclude 'apps/desktop/.env*' \
+            --exclude 'convex/.env*' \
+            ./ "$APP_DIR"/
       - name: Deploy functions to Convex self-hosted
         run: |
           docker run --rm -i \