Ops: fix Timeweb cron first-run log dir and document real web root

The documented cron command redirected to $HOME/.caterium-deploy/cron.log
before the script could create that directory, so the very first run
failed before executing. Document mkdir -p as a one-time setup step,
add $HOME/public_html to web-root auto-detection (the confirmed real
document root for this account), and note the CATERIUM_REPO_URL override
needed when the account's SSH config uses a non-default Host alias.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

ops/timeweb/README.md

@@ -6,15 +6,9 @@ Use this only for the Year/shared-hosting fallback where system `crontab` is una
 
 `caterium-production-sync.sh` checks the GitHub `production` branch, deploys only when the commit changed, validates that `public/index.html` exists, creates a rollback archive before changing live files, prevents overlapping runs, and keeps the four newest backups.
 
-## Timeweb panel Crontab
+Web root auto-detection tries, in order: `$HOME/caterium.ru/public_html`, `$HOME/app.caterium.ru/public_html`, `$HOME/public_html`. Set `CATERIUM_WEB_ROOT` explicitly to override.
 
-Create one task that runs every 5 minutes.
+## One-time setup
-
-Command:
-
-```sh
-/bin/sh "$HOME/caterium-production-sync.sh" >> "$HOME/.caterium-deploy/cron.log" 2>&1
-```
 
 Copy `ops/timeweb/caterium-production-sync.sh` from this repository to:
 
@@ -22,10 +16,38 @@ Copy `ops/timeweb/caterium-production-sync.sh` from this repository to:
 $HOME/caterium-production-sync.sh
 ```
 
-If the live document root is not auto-detected, prefix the command with the exact path, for example:
+Check it transferred with LF line endings (a CRLF copy from a Windows machine will fail `sh -n` with a syntax error around the `for` loop):
 
 ```sh
-CATERIUM_WEB_ROOT="$HOME/caterium.ru/public_html" /bin/sh "$HOME/caterium-production-sync.sh" >> "$HOME/.caterium-deploy/cron.log" 2>&1
+sh -n "$HOME/caterium-production-sync.sh" || sed -i 's/\r$//' "$HOME/caterium-production-sync.sh"
+chmod 700 "$HOME/caterium-production-sync.sh"
 ```
 
-The deploy checkout uses the already configured GitHub SSH access. The old Cloudflare Worker must remain enabled as a fallback until the Timeweb production domain, SSL, Supabase flows, uploads and PDF generation have been verified.
+The deploy checkout authenticates over the GitHub SSH deploy key already configured in `~/.ssh/config` on the account. If that config uses a `Host` alias other than `github.com` (for example `github-caterium`), pass the matching URL via `CATERIUM_REPO_URL`, e.g. `git@github-caterium:pavlov346346-source/caterium-app.git` — plain `git@github.com:...` will not pick up the alias's `IdentityFile`.
+
+Before relying on cron, create `$HOME/.caterium-deploy` once so the log redirect below has somewhere to write on the very first run:
+
+```sh
+mkdir -p "$HOME/.caterium-deploy"
+```
+
+## Timeweb panel Crontab
+
+Create one task:
+
+- Name: `Caterium production sync`
+- Schedule: every 5 minutes — minute `*/5`, hour `*`, day `*`, month `*`, weekday `*`
+
+If Timeweb offers a "Сценарий SH" interpreter option, point it directly at `$HOME/caterium-production-sync.sh` (simplest, no shell redirection to worry about).
+
+If it only offers an arbitrary command, use:
+
+```sh
+mkdir -p "$HOME/.caterium-deploy" && CATERIUM_REPO_URL="git@github-caterium:pavlov346346-source/caterium-app.git" /bin/sh "$HOME/caterium-production-sync.sh" >> "$HOME/.caterium-deploy/cron.log" 2>&1
+```
+
+The leading `mkdir -p` matters: without it, the very first cron run fails before the script even starts, because the shell opens the log file for the `>>` redirect before executing anything, and `$HOME/.caterium-deploy` does not exist yet on a fresh account.
+
+Only override `CATERIUM_WEB_ROOT` in the command above if auto-detection (see above) does not match your account's actual document root — verify the real path first (e.g. by checking what a plain HTTP request to the domain currently serves) rather than assuming `$HOME/public_html`.
+
+The old Cloudflare Worker must remain enabled as a fallback until the Timeweb production domain, SSL, Supabase flows, uploads and PDF generation have been verified.

ops/timeweb/caterium-production-sync.sh

@@ -25,7 +25,8 @@ find_web_root() {
 
   for candidate in \
     "$HOME/caterium.ru/public_html" \
-    "$HOME/app.caterium.ru/public_html"
+    "$HOME/app.caterium.ru/public_html" \
+    "$HOME/public_html"
   do
     if [ -d "$candidate" ] && [ -f "$candidate/index.html" ]; then
       printf '%s\n' "$candidate"