fix(ci): add workflow_call trigger so deploy.yml can reuse it

[MorganOnCode]

The actual cause of the broken auto-deploy

Found while verifying PR #24's auto-deploy on master: the deploy workflow failed at parse time again, this time not at the SSH path (which #24 fixed) but at the preflight step.

`deploy.yml` line 16:
```yaml
jobs:
ci:
uses: ./.github/workflows/ci.yml
```

This is GitHub's reusable-workflow syntax. For it to work, the called workflow (`ci.yml`) must declare `workflow_call:` in its `on:` block. It didn't — only `push` and `pull_request` were listed. GitHub Actions rejects the deploy workflow before it starts, which is why every deploy run shows a 0-second `failure` with no logs.

So PR #24's path correction was right, but the workflow never got far enough to use it. This is the upstream cause.

Fix

One-line addition to `.github/workflows/ci.yml` `on:` block:

```yaml
workflow_call:
```

Test plan

After merge:

• The deploy.yml run for THIS merge should no longer show a 0s failure
• The `ci` job inside deploy.yml should run all the existing CI steps (lint, typecheck, test, build, docker, security)
• After `ci` passes, the `deploy` job will attempt SSH — at this point we'll discover whether the `DEPLOY_HOST` / `DEPLOY_USER` / `DEPLOY_SSH_KEY` / `DEPLOY_PORT` secrets are configured (`gh secret list` returned empty, so they may not be)
• If secrets are missing, the deploy job will fail loudly at the SSH step instead of silently at parse time

🤖 Generated with Claude Code