restart on secrets update

main.go

@@ -1099,8 +1099,8 @@ func runDeploy() error {
 		return fmt.Errorf("failed to sync local directories: %w", err)
 	}
 
-	if err := runSSHCommand(ctx.serverIP, systemdRestartScript(ctx.serviceName)); err != nil {
+	if err := restartPocketBaseService(ctx); err != nil {
-		return fmt.Errorf("systemd restart failed: %w", err)
+		return err
 	}
 
 	fmt.Printf("\nDeployment complete; PocketBase should be reachable at https://%s\n", ctx.domain)
@@ -1240,7 +1240,11 @@ func runSecretsSet(ctx *deploymentContext, pairs []string) error {
 		return err
 	}
 
-	fmt.Printf("updated %d secrets\n", len(assignments))
+	if err := restartPocketBaseService(ctx); err != nil {
+		return err
+	}
+
+	fmt.Printf("updated %d secrets and restarted PocketBase\n", len(assignments))
 	return nil
 }
 
@@ -1267,7 +1271,11 @@ func runSecretsDelete(ctx *deploymentContext, keys []string) error {
 		return err
 	}
 
-	fmt.Printf("removed %d secrets\n", len(normalized))
+	if err := restartPocketBaseService(ctx); err != nil {
+		return err
+	}
+
+	fmt.Printf("removed %d secrets and restarted PocketBase\n", len(normalized))
 	return nil
 }
 
@@ -1589,6 +1597,13 @@ systemctl --no-block restart pb@%s
 `, serviceName)
 }
 
+func restartPocketBaseService(ctx *deploymentContext) error {
+	if err := runSSHCommand(ctx.serverIP, systemdRestartScript(ctx.serviceName)); err != nil {
+		return fmt.Errorf("systemd restart failed: %w", err)
+	}
+	return nil
+}
+
 func runSSHCommand(server, script string) error {
 	remoteCmd := fmt.Sprintf("bash --noprofile --norc -c %s", shellQuote(script))
 	cmd := exec.Command("ssh", append(sshArgs(server), remoteCmd)...)