fix(supervisor+ci): self-restart on deploy, CI creates date-based tags

supervisor: after git checkout + uv sync, os.execv replaces the running
process so new code takes effect immediately without a manual systemd
restart. systemd sees the same PID, so the unit stays "active".

ci: changed tag format from v{run_number} to v{YYYYMMDDHHMM}, matching
the supervisor's deploy tag convention. Sequential v<N> tags conflicted
with manual date-based tags causing an infinite redeploy loop.
No more manual tagging needed — CI tags automatically after green tests.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -17,9 +17,9 @@ jobs:
       - run: uv run pytest web/tests/ -x -q -p no:faulthandler
       - run: uv run ruff check web/src/ web/tests/
 
-  # Creates v<N> tag after tests pass. The on-server supervisor polls for new
-  # tags every 60s and deploys automatically. No SSH keys or deploy credentials
-  # needed in CI — only the built-in github.token.
+  # Creates a v{YYYYMMDDHHMM} tag after tests pass on master.
+  # The on-server supervisor polls for new tags every 60s and deploys
+  # automatically. No SSH keys or deploy credentials needed in CI.
   tag:
     needs: [test]
     runs-on: ubuntu-latest
@@ -32,5 +32,6 @@ jobs:
         run: |
           git config user.name "CI"
           git config user.email "ci@noreply"
-          git tag "v${{ github.run_number }}"
-          git push origin "v${{ github.run_number }}"
+          TAG="v$(date -u +%Y%m%d%H%M)"
+          git tag "$TAG"
+          git push origin "$TAG"

src/padelnomics/supervisor.py

@@ -279,12 +279,18 @@ def web_code_changed() -> bool:
 
 
 def current_deployed_tag() -> str | None:
-    """Return the tag currently checked out, or None if not on a tag."""
+    """Return the highest-version tag pointing at HEAD, or None.
+
+    Uses the same sort order as latest_remote_tag() so that when multiple
+    tags point to the same commit (e.g. a date-based tag and a CI integer
+    tag), we always compare apples-to-apples.
+    """
     result = subprocess.run(
-        ["git", "describe", "--tags", "--exact-match", "HEAD"],
+        ["git", "tag", "--list", "--sort=-version:refname", "--points-at", "HEAD", "v*"],
         capture_output=True, text=True, timeout=10,
     )
-    return result.stdout.strip() or None
+    tags = result.stdout.strip().splitlines()
+    return tags[0] if tags else None
 
 
 def latest_remote_tag() -> str | None:
@@ -321,6 +327,10 @@ def git_pull_and_sync() -> None:
     run_shell(f"git checkout --detach {latest}")
     run_shell("sops --input-type dotenv --output-type dotenv -d .env.prod.sops > .env")
     run_shell("uv sync --all-packages")
+    # Re-exec so the new code is loaded. os.execv replaces this process in-place;
+    # systemd sees it as the same PID and does not restart the unit.
+    logger.info("Deploy complete — re-execing to load new code")
+    os.execv(sys.executable, sys.argv)
 
 
 # ---------------------------------------------------------------------------