ci(deploy): preempt self-update timer so it can't starve the deploy lock (#72)

* ci(deploy): preempt self-update timer so it can't starve the deploy lock

The self-update systemd timer redeploys from source (no SKIP_BUILD) and
can hold setup.sh's flock for >5min while compiling on a tiny droplet.
When it fires close to a CI push it starves the deploy, which waits the
full 5min on the lock and then fails with 'another setup.sh run is in
progress (lock held >5m)'.

The CI push is authoritative (ships prebuilt binaries + resets to the
exact commit), so stop any in-flight timer run to release the lock and
pause the timer before taking it. setup.sh re-enables the timer at the
end of its run.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(files): isolate over-quota test from seeded-README baseline

TestWebSaveOverQuotaPreservesExistingFile set quota=5 but left sess.used
at the newSession baseline, which already counts the README.txt that
ensureUserPub seeds into /public (added in d19c5c4). That baseline alone
exceeds 5 bytes, so the initial 2-byte save was rejected with
'quota exceeded' before the test could exercise the over-quota replace.

Reset sess.used to 0 after setting the tiny quota, mirroring
TestQuotaEnforced, so the writer starts from a clean gauge.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

internal/files/files_test.go

@@ -173,6 +173,7 @@ func TestWebSaveOverQuotaPreservesExistingFile(t *testing.T) {
 	svc, _, u := newTestService(t)
 	sess, _ := svc.newSession(u)
 	sess.quota = 5
+	sess.used.Store(0) // isolate the writer from the seeded-README baseline
 
 	if _, err := sess.webSave("/me/note.txt", strings.NewReader("ok")); err != nil {
 		t.Fatalf("initial save failed: %v", err)