fix(ci): replace deprecated apt-key with gpg dearmor and use robust keyserver fetch

.gitea/workflows/deploy.yml

@@ -349,11 +349,12 @@ jobs:
         run: |
           apt-get update
           apt-get install -y gnupg wget
-          # Manually add xtradeb PPA (avoids software-properties-common dependency)
-          # Works for Ubuntu; for Debian it might fail, so we continue-on-error
+          # Manually add xtradeb PPA with modern signed-by (avoids software-properties-common dependency)
+          # Works for Ubuntu; uses port 80 for better keyserver reliability
           export CODENAME=$(. /etc/os-release && echo $VERSION_CODENAME)
-          echo "deb http://ppa.launchpad.net/xtradeb/apps/ubuntu $CODENAME main" > /etc/apt/sources.list.d/xtradeb-ppa.list
-          apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 290D73D2240900B5
+          mkdir -p /etc/apt/keyrings
+          wget -qO- "http://keyserver.ubuntu.com/pks/lookup?op=get&search=0x290d73d2240900b5" | gpg --dearmor > /etc/apt/keyrings/xtradeb.gpg
+          echo "deb [signed-by=/etc/apt/keyrings/xtradeb.gpg] http://ppa.launchpad.net/xtradeb/apps/ubuntu $CODENAME main" > /etc/apt/sources.list.d/xtradeb-ppa.list
           apt-get update
           apt-get install -y chromium
         continue-on-error: true