Deploy enables the instance unit

A host reboot on 2026-08-30 left the instance down: deploys only ever
started it. enable is best-effort until the host's polkit rule grants
manage-unit-files to deploy-runner.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -85,9 +85,16 @@ jobs:
       # No sudo: the runner's unit sets NoNewPrivileges=yes - systemctl
       # talks to PID1 over D-Bus, authorized by the polkit rule scoped
       # to deploy-runner + the app@* unit pattern.
+      # enable: the unit must come back after a host reboot (2026-08-30 a
+      # reboot left both portal instances down - deploys had only ever
+      # started them). Needs the manage-unit-files polkit grant; until
+      # that's on the host the enable is reported and skipped, never a
+      # failed deploy.
       - name: Activate and restart
         run: |
           ln -sfn "/srv/app/$INSTANCE/releases/$PORTAL_RELEASE" /srv/app/$INSTANCE/current
+          systemctl enable app@$INSTANCE.service \
+            || echo "::warning::could not enable app@$INSTANCE (polkit) - unit will not survive a reboot"
           systemctl restart app@$INSTANCE.service
 
       # Apex and www are separate cookie scopes (no shared Domain