Triggers on push to main and manual workflow_dispatch. Builds with
Node 20, runs astro check, builds the static site, then mirrors
./dist via SFTP using the SFTP_* secrets configured on the repo.
Password-based SFTP for now (matches the credentials we have). Swap to
key-based by adding SFTP_KEY as a secret and tweaking the lftp call
when the production site user is created.