fix: sac-deploy validate sac-api.env without bash source

Preflight pydantic parse catches inline comments in env values; alembic
and stale remote_action reset use SAC_CONFIG_FILE. Document env format
and ssh_known_hosts in runbook.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/env.native.example

@@ -128,6 +128,7 @@ SAC_MOBILE_REFRESH_EXPIRE_DAYS=90
 CORS_ORIGINS=https://sac.kalinamall.ru
 
 # SSH: verify host keys (RejectPolicy). Add keys to file before remote actions.
+# Комментарий — только отдельной строкой с #. Нельзя: SAC_SSH_AUTO_ADD_HOST_KEY=false ← текст
 # SAC_SSH_KNOWN_HOSTS_FILE=/opt/security-alert-center/config/ssh_known_hosts
 # SAC_SSH_AUTO_ADD_HOST_KEY=false
 

deploy/sac-deploy.sh

@@ -56,12 +56,16 @@ fi
 log "pip install -r requirements.txt"
 sudo -u "${APP_USER}" "${VENV}/bin/pip" install -q -r "${APP_ROOT}/backend/requirements.txt"
 
+log "Проверка ${CONFIG_FILE} (pydantic; без bash source — inline-комментарии в значениях ломают deploy)"
+sudo -u "${APP_USER}" bash -c "
+  export SAC_CONFIG_FILE='${CONFIG_FILE}'
+  cd '${APP_ROOT}/backend'
+  '${VENV}/bin/python' -c 'from app.config import get_settings; get_settings(); print(\"config: OK\")'
+" || die "Неверный ${CONFIG_FILE}: одна переменная = одна строка, комментарии только отдельной строкой с # (не «false ← …» после значения)"
+
 log "alembic upgrade head"
 sudo -u "${APP_USER}" bash -c "
-  set -a
-  # shellcheck source=/dev/null
-  source '${CONFIG_FILE}'
-  set +a
+  export SAC_CONFIG_FILE='${CONFIG_FILE}'
   cd '${APP_ROOT}/backend' && '${VENV}/bin/alembic' upgrade head
 "
 
@@ -107,10 +111,7 @@ print('db: OK')
 log "systemctl restart ${SERVICE_NAME} (краткий 502 в UI возможен ~10 с)"
 log "Сброс зависших remote_action (running без worker после restart)"
 sudo -u "${APP_USER}" bash -c "
-  set -a
-  # shellcheck source=/dev/null
-  source '${CONFIG_FILE}'
-  set +a
+  export SAC_CONFIG_FILE='${CONFIG_FILE}'
   cd '${APP_ROOT}/backend'
   '${VENV}/bin/python' -c \"
 from app.database import SessionLocal