fix: show benchmark job in admin; harden + split deploy workflow

- admin_service: register benchmark_collector in VALID_JOB_NAMES, JOB_LABELS and
  PIPELINE_MEMBERS. The Admin → Jobs list is built from these hardcoded sets, not
  the scheduler, so the job was registered but invisible/untriggerable.

- deploy.yml:
  - SSH: verify the host key (StrictHostKeyChecking=yes) now that known_hosts is
    supplied; move private-key cleanup to an `if: always()` step.
  - Add a concurrency guard so deploys serialize.
  - Health-check the service after restart (127.0.0.1:8998/api/v1/health).
  - Align CI Python to 3.12 (matches prod); pip + npm caching.
  - Clarify the Postgres service only validates migrations (tests use SQLite);
    drop the redundant DATABASE_URL from the pytest step.
  - Split the monolithic "Deploy to server" step into named steps.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/services/admin_service.py

@@ -512,6 +512,7 @@ async def get_pipeline_readiness(db: AsyncSession) -> list[dict]:
 VALID_JOB_NAMES = {
     "data_collector",
     "data_backfill",
+    "benchmark_collector",
     "sentiment_collector",
     "fundamental_collector",
     "rr_scanner",
@@ -529,6 +530,7 @@ VALID_JOB_NAMES = {
 JOB_LABELS = {
     "data_collector": "Data Collector (OHLCV)",
     "data_backfill": "Data Backfill (deep history)",
+    "benchmark_collector": "Benchmark Collector",
     "sentiment_collector": "Sentiment Collector",
     "fundamental_collector": "Fundamental Collector",
     "rr_scanner": "R:R Scanner",
@@ -546,6 +548,7 @@ JOB_LABELS = {
 # Jobs driven by the daily_pipeline (in order) rather than their own timer.
 PIPELINE_MEMBERS = {
     "data_collector",
+    "benchmark_collector",
     "sentiment_collector",
     "rr_scanner",
     "outcome_evaluator",