Read Cloudflare credentials from ~/.config/gitsite/env

The account id was inline in deploy.sh. That was fine while this repo was
private; it stopped being reasonable when gitsite was added to repos.conf and
started publishing itself to git.lucas.co.

Both the token and the account id now come from ~/.config/gitsite/env, mode
600 and outside the repo -- the same shape restic-backup.sh already uses for
its backend credentials. GITSITE_ENV_FILE overrides the path.

~/.config/gitsite-cf-token (token only) is still honoured when the env file is
absent, so a second machine keeps deploying until it is migrated; wrangler
falls back to the account id in its own cache, which is how this worked
before. All three paths were exercised with the wrangler call stubbed out.

This does not make the id private -- it remains in this repo's history, and it
is an identifier rather than a credential: useless without the token, which
has never been in the repo.

 deploy.sh  | 18 +++++++++++++++---
 readme.txt | 19 +++++++++++++++++++
 2 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/deploy.sh b/deploy.sh
index e014e2f..0d5826d 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -8,11 +8,23 @@ OUT="$HOME/.cache/gitsite/out"
 
 # Token auth when available: wrangler refuses OAuth in non-interactive
 # environments (e.g. the gitsite.timer systemd unit).
-TOKEN_FILE="$HOME/.config/gitsite-cf-token"
-if [ -f "$TOKEN_FILE" ]; then
+#
+# Credentials and account identifiers live outside the repo, mode 600, the
+# way restic-backup.sh keeps its own. They used to be here: the token was
+# already read from a file, but the account id was inline -- fine while this
+# repo was private, less so now that gitsite publishes itself to
+# git.lucas.co. Nothing secret belongs in this file.
+ENV_FILE="${GITSITE_ENV_FILE:-$HOME/.config/gitsite/env}"
+TOKEN_FILE="$HOME/.config/gitsite-cf-token"   # older layout, token only
+
+if [ -f "$ENV_FILE" ]; then
+    . "$ENV_FILE"
+    export CLOUDFLARE_API_TOKEN CLOUDFLARE_ACCOUNT_ID
+elif [ -f "$TOKEN_FILE" ]; then
+    # A machine that has not been migrated yet. Without an account id wrangler
+    # falls back to the one in its own cache, which is how this used to work.
     CLOUDFLARE_API_TOKEN=$(tr -d '[:space:]' < "$TOKEN_FILE")
     export CLOUDFLARE_API_TOKEN
-    export CLOUDFLARE_ACCOUNT_ID=16cc27b259a59a98845182903fee02e4
 fi
 
 # Pinned: wrangler 4.121.0 ships a dependency on a nonexistent miniflare
diff --git a/readme.txt b/readme.txt
index ed99bad..6976eb9 100644
--- a/readme.txt
+++ b/readme.txt
@@ -53,6 +53,25 @@ One-time Cloudflare setup
 3. Cloudflare dashboard -> Workers & Pages -> git-lucas-co ->
    Custom domains -> add git.lucas.co
 
+Credentials
+-----------
+deploy.sh reads ~/.config/gitsite/env (mode 600, NOT versioned), the same
+shape restic-backup.sh uses:
+
+    CLOUDFLARE_API_TOKEN=...
+    CLOUDFLARE_ACCOUNT_ID=...
+
+A token is needed for unattended runs: wrangler refuses OAuth in
+non-interactive environments, so the gitsite.timer unit cannot use a login
+session. The account id used to be inline in deploy.sh, which stopped being
+reasonable once this repo started publishing itself to git.lucas.co. It is
+still in this repo's git history; it is an identifier rather than a
+credential, and does nothing without the token, which has never been in the
+repo.
+
+The older ~/.config/gitsite-cf-token (token only, no account id) is still
+honoured as a fallback for a machine that has not been migrated.
+
 Notes
 -----
 - website repo is mode "browse" because its history is 452MB of media;