Add drift detection and removal as a real deployment

A drift deployment scans each server's sp/ tree for files not in the
server_scripts inventory (untracked scripts left over from before EC was
managing the fleet), deletes them, and records the removed bytes in
deployment_files for audit. The existing sweep then runs the standard
wait-for-empty → Komodo restart cycle on each affected server.

To make that cycle safer, the sweep now has a second phase: after Komodo
restart succeeds we wait for komodoInspectHealthy + RCON to both come
back green before marking the deployment_server row 'done'. If either
stays broken the row stays pending and keeps retrying.

New: /api/drift (GET scan, POST run), drift panel on /deployments.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/routes/deployments/+page.svelte

@@ -17,13 +17,59 @@
         servers: ServerRow[];
     }
 
+    interface DriftFile { relPath: string; size: number; sha256: string }
+    interface DriftServer { server: string; files: DriftFile[] }
+    interface DriftPreview { totalDrift: number; servers: DriftServer[] }
+
     let deployments = $state<Deployment[]>([]);
     let loading = $state(true);
+    let drift = $state<DriftPreview | null>(null);
+    let scanning = $state(false);
+    let running = $state(false);
+    let flash = $state<string | null>(null);
 
-    onMount(async () => {
+    async function loadDeployments(): Promise<void> {
         const res = await fetch('/api/deployments');
         const body = (await res.json()) as { deployments: Deployment[] };
         deployments = body.deployments;
+    }
+
+    async function scanDrift(): Promise<void> {
+        scanning = true;
+        try {
+            const res = await fetch('/api/drift');
+            drift = (await res.json()) as DriftPreview;
+        } finally {
+            scanning = false;
+        }
+    }
+
+    async function runDrift(): Promise<void> {
+        if (!drift || drift.totalDrift === 0) return;
+        if (!confirm(`Remove ${drift.totalDrift} untracked file(s) across ${drift.servers.length} server(s)?`)) return;
+        running = true;
+        flash = null;
+        try {
+            const res = await fetch('/api/drift', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({})
+            });
+            const body = (await res.json()) as {
+                ok: boolean;
+                error?: string;
+                result?: { deploymentId: string | null; totalRemoved: number; totalServers: number };
+            };
+            if (!body.ok) { flash = body.error ?? 'drift run failed'; return; }
+            flash = `removed ${body.result?.totalRemoved ?? 0} files across ${body.result?.totalServers ?? 0} servers`;
+            await Promise.all([loadDeployments(), scanDrift()]);
+        } finally {
+            running = false;
+        }
+    }
+
+    onMount(async () => {
+        await Promise.all([loadDeployments(), scanDrift()]);
         loading = false;
     });
 
@@ -52,6 +98,35 @@
 {#if loading}
     <p class="empty">loading…</p>
 {:else}
+    <section class="drift-panel">
+        <div class="drift-head">
+            <h2>Drift{drift ? ` · ${drift.totalDrift} untracked file${drift.totalDrift === 1 ? '' : 's'}` : ''}</h2>
+            <div class="drift-actions">
+                <button onclick={scanDrift} disabled={scanning || running}>{scanning ? 'scanning…' : 'rescan'}</button>
+                <button class="primary" onclick={runDrift} disabled={running || scanning || !drift || drift.totalDrift === 0}>
+                    {running ? 'removing…' : 'remove drift'}
+                </button>
+            </div>
+        </div>
+        {#if drift === null}
+            <p class="empty">scan hasn't run yet</p>
+        {:else if drift.totalDrift === 0}
+            <p class="empty">inventory matches disk — no drift</p>
+        {:else}
+            {#each drift.servers as s (s.server)}
+                <div class="drift-server">
+                    <div class="drift-server-head mono">{s.server} · {s.files.length} file{s.files.length === 1 ? '' : 's'}</div>
+                    <div class="drift-files">
+                        {#each s.files as f (f.relPath)}
+                            <span class="drift-file mono" title="{f.size}B · {f.sha256.slice(0, 12)}">{f.relPath}</span>
+                        {/each}
+                    </div>
+                </div>
+            {/each}
+        {/if}
+        {#if flash}<p class="flash">{flash}</p>{/if}
+    </section>
+
     <section>
         <h2>Active</h2>
         {#if active.length === 0}
@@ -168,4 +243,52 @@
         font-family: var(--font-mono);
         font-size: var(--text-base);
     }
+
+    .drift-panel {
+        background: var(--bg-nav);
+        border: 1px solid var(--border);
+        border-radius: var(--r-md);
+        padding: var(--pad-panel);
+        margin-bottom: var(--gap-section);
+    }
+    .drift-head { display: flex; justify-content: space-between; align-items: baseline; margin-bottom: 14px; }
+    .drift-head h2 { margin: 0; }
+    .drift-actions { display: flex; gap: 8px; }
+    .drift-actions button {
+        background: var(--bg-card);
+        color: var(--ink-100);
+        border: 1px solid var(--border);
+        border-radius: var(--r-sm);
+        padding: 8px 16px;
+        font-family: var(--font-body);
+        font-size: var(--text-sm);
+        cursor: pointer;
+    }
+    .drift-actions button:hover:not(:disabled) { border-color: var(--accent); box-shadow: var(--accent-glow); }
+    .drift-actions button.primary {
+        background: linear-gradient(180deg, var(--danger-500), #a01e39);
+        border-color: rgba(255, 48, 80, 0.6);
+        color: var(--cream);
+        font-weight: 600;
+    }
+    .drift-actions button:disabled { opacity: 0.4; cursor: default; }
+    .drift-server {
+        background: var(--bg-card);
+        border: 1px solid var(--border);
+        border-radius: var(--r-sm);
+        padding: 10px 14px;
+        margin: 8px 0;
+    }
+    .drift-server-head { color: var(--cream); font-size: var(--text-mono); margin-bottom: 6px; }
+    .drift-files { display: flex; flex-wrap: wrap; gap: 6px; }
+    .drift-file {
+        background: rgba(255, 48, 80, 0.08);
+        border: 1px solid rgba(255, 48, 80, 0.25);
+        color: var(--danger-500);
+        padding: 3px 8px;
+        border-radius: var(--r-sm);
+        font-size: var(--text-mono-sm);
+    }
+    .flash { color: var(--spark-400); font-family: var(--font-mono); font-size: var(--text-mono); margin-top: 12px; }
+    .mono { font-family: var(--font-mono); }
 </style>