fix(cms): robust git publish workflow and untracked env handling

- add .env.staging and .env.production patterns to .gitignore so local env files are ignored
- use robust publish command: git add . && (git diff --cached --quiet || git commit ...) && git pull --rebase origin main && git push origin main
- expand no-changes detection in publish response handling

Closes MITHOME-59

content-editor.js

@@ -291,7 +291,7 @@ const server = http.createServer(async (req, res) => {
     return;
   }
 
-  // POST /publish — Git Commit & Push
+  // POST /publish — Git Commit, Pull Rebase & Push
   if (req.method === 'POST' && u.pathname === '/publish') {
     if (exceedsRateLimit(`publish:${clientAddress}`, PUBLISH_MAX_ATTEMPTS)) {
       writeAudit('publish_rate_limited', { clientAddress, user: CMS_USER });
@@ -299,22 +299,25 @@ const server = http.createServer(async (req, res) => {
       res.end(JSON.stringify({ ok: false, error: 'Túl sok publikálási kísérlet' }));
       return;
     }
-    exec('git add . && git commit -m "content: frissítve a CMS-ből" && git push', { cwd: CONTENT_DIR }, (error, stdout, stderr) => {
+
+    // WHY: (git diff --cached --quiet || git commit) ensures we only commit when
+    // staged changes exist. git pull --rebase origin main integrates remote changes
+    // (or unpushed local commits) cleanly before git push origin main.
+    const publishCmd = 'git add . && (git diff --cached --quiet || git commit -m "content: frissítve a CMS-ből") && git pull --rebase origin main && git push origin main';
+
+    exec(publishCmd, { cwd: CONTENT_DIR }, (error, stdout, stderr) => {
       res.writeHead(200, { 'Content-Type': 'application/json' });
-      if (error) {
-        // If there's nothing to commit, it's fine
-        if (stdout.includes('nothing to commit') || stdout.includes('working tree clean')) {
-          writeAudit('publish_finished', { clientAddress, user: CMS_USER, result: 'no_changes' });
-          res.end(JSON.stringify({ ok: true, output: 'No changes to commit' }));
-        } else {
-          writeAudit('publish_finished', { clientAddress, user: CMS_USER, result: 'error' });
-          res.end(JSON.stringify({ ok: false, error: stderr || stdout || error.message }));
-        }
+      const combinedOutput = `${stdout}\n${stderr}`;
+      const isNoChanges = /nothing to commit|nothing added to commit|working tree clean|everything up-to-date|already up to date/i.test(combinedOutput);
+
+      if (error && !isNoChanges) {
+        writeAudit('publish_finished', { clientAddress, user: CMS_USER, result: 'error' });
+        res.end(JSON.stringify({ ok: false, error: stderr || stdout || error.message }));
       } else {
         // Deploy only the explicitly configured environment; never default to production.
         exec(`cd ../../../ && ./deploy.sh ${CMS_DEPLOY_ENV} > deploy.log 2>&1 &`);
-        writeAudit('publish_finished', { clientAddress, user: CMS_USER, result: 'ok' });
-        res.end(JSON.stringify({ ok: true, output: stdout }));
+        writeAudit('publish_finished', { clientAddress, user: CMS_USER, result: isNoChanges ? 'no_changes' : 'ok' });
+        res.end(JSON.stringify({ ok: true, output: stdout || 'Sikeres publikálás' }));
       }
     });
     return;