feat(deploy): switch to dash 4 — dash-proxy features, doctor pre-flight

[mhenrixon]

Summary

• Reusable deploy.yml installs dash -v "~> 4.0" and runs dash doctor (pre-flight: host, registry, proxy incl. the 4.0 migration, ports, readiness gates — raises DoctorError → job fails) before dash deploy --skip-push --version=…
• Registry secret renamed to DASH_REGISTRY_PASSWORD; KAMAL_REGISTRY_PASSWORD is still exported so sibling sites on a scaffolded .kamal/secrets keep deploying (dash reads a legacy .kamal/ until 5.0)
• docs/config/deploy.yml + the docs-kit new template now use dash-proxy properly:
  • minimum_version: 4.0.0, retain_containers: 2, error_pages_path: public (+ public/502|503|504.html)
  • proxy.compress: true, proxy.cache { enabled, max_ttl: 300 }, security headers (nosniff, Referrer-Policy, strip Server/X-Powered-By), intercept_errors: [502,503,504], exclude_metrics_paths: [/up]
• Deliberately not set: proxy.run (host-wide; sibling sites share the proxy and a differing run: reboots it each alternate deploy), rate_limit/deny_ips/client_ip (dash rejects client_ip without an access-control feature, and trusted_proxies must be the tunnel's address — unknown from here)
• docs/.kamal/secrets → docs/.dash/secrets; both .dockerignores exclude /.dash/; README + Deploy docs page document the features and the one-off 4.0 proxy-rename outage

Test plan

• bundle exec rake green (94.7% line coverage, rubocop clean); docs-site rspec 15/15
• dash config on dash main (000affd, the 4.0.0 commit) accepts the new deploy.yml (validated with minimum_version temporarily lowered — main still reads 3.2.1 until the release bump)
• After dash 4.0.0 lands on RubyGems: trigger Deploy docs (workflow_dispatch) here — expect the doctor report, then the one-off kamal-proxy → dash-proxy migration (short outage on the shared host) and a green deploy
• Sibling sites (daisyui, phlex-reactive, pgbus): dash migrate, rename the secret, and copy the proxy: block when convenient — the first of them to deploy after this pays no extra outage, the host is already migrated

https://claude.ai/code/session_01SdEc37DFCkYzwpQpadu9My

[cubic-dev-ai]

Running ultrareview automatically — This PR swaps the deployment tool from Kamal to dash across the reusable workflow, templates, and secrets; a subtle incompatibility or secret mismatch could silently break deploys for every docs-kit site.. I'll post findings when complete.

[cubic-dev-ai]

I can't run this ultrareview because your workspace has reached its monthly review limit. cubic has reviewed 102,664 of the 80,000 allowed lines of code this month. Reviews resume on 10 September 2026 (in 15 days). Enable flex capacity to cover overages automatically and resume reviews now. Learn how flex capacity works.

To help optimise your usage, you can tune cubic to get the most out of your usage limits:

• Stop reviewing test files
• Turn off incremental reviews
• Use the cubic CLI locally
• Skip non-default base branches

Learn more →