Portfolio sync runs on the Cleura server (systemd timer every 20 min) instead of n8n -> Nurem

deploy/cleura/portfolio-sync.sh: same steps as /opt/immich-sync/run-sync.sh on Nurem (fetch main, portfolio-sync.mjs,
commit + push when photos changed) and then build-live.sh main on Cleura; flock against overlapping runs, the sync
runs in the pinned Node container. install-portfolio-sync.sh puts it in place; secrets stay in
/etc/portal/portfolio-sync.env (root 600). The snippet comment no longer mentions the removed /download/original.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/cleura/install-portfolio-sync.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# deploy/cleura/install-portfolio-sync.sh – installs the portfolio sync on the Cleura server (run as root from a
+# checkout of this repo). Needs /etc/portal/portfolio-sync.env (root 600) first; see portfolio-sync.sh for the keys.
+# Undo: systemctl disable --now portfolio-sync.timer && rm /etc/systemd/system/portfolio-sync.{service,timer}
+set -euo pipefail
+HERE=$(cd "$(dirname "$0")" && pwd)
+ENVF=/etc/portal/portfolio-sync.env
+[ -f "$ENVF" ] || { echo "$ENVF is missing - copy IMMICH_URL, PORTFOLIO_TAG_ID, IMMICH_API_KEY and GIT_URL there first"; exit 2; }
+[ "$(stat -c %a "$ENVF")" = "600" ] || chmod 600 "$ENVF"
+install -m 755 -o root -g root "$HERE/portfolio-sync.sh" /opt/portal/site/portfolio-sync.sh
+install -m 644 -o root -g root "$HERE/portfolio-sync.service" /etc/systemd/system/portfolio-sync.service
+install -m 644 -o root -g root "$HERE/portfolio-sync.timer" /etc/systemd/system/portfolio-sync.timer
+systemctl daemon-reload
+systemctl enable --now portfolio-sync.timer
+systemctl list-timers portfolio-sync.timer --no-pager