Add safe deploy script preserving data directory

README.md

@@ -148,6 +148,16 @@ Requirements for full functionality:
 - Nginx or Apache (for `/s/` short URL rewrites)
 - Writable `data/` directory
 
+### Production Deploy (Safe)
+
+Use the provided deploy script to avoid deleting runtime files in `data/`:
+
+```bash
+./scripts/deploy.sh
+```
+
+This script deploys with `rsync --delete` but explicitly excludes `data/`.
+
 ---
 
 ## Security

scripts/deploy.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Safe deploy: never delete server-side runtime data/ files.
+HOST="root@REDACTED"
+TARGET="/home/REDACTED/public_html"
+
+rsync -avz --delete \
+  --exclude '.git' \
+  --exclude 'node_modules' \
+  --exclude 'data/' \
+  ./ "$HOST:$TARGET"
+
+echo "Deploy complete (data/ preserved)."