feat(preview): add cross-repo preview linking via PR body

Parse <!-- preview-link: tasks=N --> from PR body to automatically
connect opencouncil previews to opencouncil-tasks previews.

- Add workflow step to parse preview-link directive
- Write TASK_API_URL and TASK_API_KEY to per-preview .env.local
- Load .env.local in start script for runtime overrides
- Show linked tasks preview in PR comment and step summary

Author: kouloumos

.github/workflows/preview-deploy.yml

@@ -189,13 +189,33 @@ jobs:
               body: body,
             });
 
+      - name: Parse preview links from PR body
+        id: preview-links
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const prBody = context.payload.pull_request.body || '';
+
+            // Parse <!-- preview-link: tasks=N --> from PR body
+            const tasksMatch = prBody.match(/<!--\s*preview-link:\s*tasks=(\d+)\s*-->/i);
+            if (tasksMatch) {
+              const tasksPrNum = tasksMatch[1];
+              core.setOutput('tasks-pr', tasksPrNum);
+              console.log(`Found linked tasks preview: PR #${tasksPrNum}`);
+            } else {
+              core.setOutput('tasks-pr', '');
+              console.log('No linked tasks preview found in PR body');
+            }
+
       - name: Deploy to preview host
         env:
           SSH_PRIVATE_KEY: ${{ secrets.PREVIEW_DEPLOY_SSH_KEY }}
           PREVIEW_HOST: ${{ secrets.PREVIEW_HOST }}
           PREVIEW_USER: ${{ secrets.PREVIEW_USER || 'opencouncil' }}
           STORE_PATH: ${{ steps.store-path.outputs.path }}
           HAS_MIGRATIONS: ${{ needs.check-migrations.outputs.has-migrations }}
+          LINKED_TASKS_PR: ${{ steps.preview-links.outputs.tasks-pr }}
+          PREVIEW_TASKS_API_KEY: ${{ secrets.PREVIEW_TASKS_API_KEY }}
         run: |
           set -euo pipefail
 
@@ -221,6 +241,19 @@ jobs:
 
           # The droplet pulls the build from Cachix automatically (configured as a substituter).
           # Just SSH in and create the preview — nix-store --realise is called by the create script.
+
+          # Write per-preview env overrides BEFORE create (so service picks them up on first start)
+          if [ -n "${LINKED_TASKS_PR:-}" ]; then
+            echo "🔗 Linking to tasks preview PR #$LINKED_TASKS_PR"
+            TASKS_URL="https://pr-${LINKED_TASKS_PR}.tasks.opencouncil.gr"
+            $SSH_CMD "mkdir -p /var/lib/opencouncil-previews/pr-$PR_NUM && cat > /var/lib/opencouncil-previews/pr-$PR_NUM/.env.local <<EOF
+# Linked tasks preview (from PR body: <!-- preview-link: tasks=$LINKED_TASKS_PR -->)
+TASK_API_URL=$TASKS_URL
+TASK_API_KEY=${PREVIEW_TASKS_API_KEY:-}
+EOF
+chmod 600 /var/lib/opencouncil-previews/pr-$PR_NUM/.env.local"
+          fi
+
           echo "Creating/updating preview instance..."
           $SSH_CMD "sudo opencouncil-preview-create '$PR_NUM' '$STORE_PATH' $DEPLOY_FLAGS"
 
@@ -233,6 +266,9 @@ jobs:
           else
             echo "Database: Shared staging" >> $GITHUB_STEP_SUMMARY
           fi
+          if [ -n "${LINKED_TASKS_PR:-}" ]; then
+            echo "Tasks API: https://pr-${LINKED_TASKS_PR}.tasks.opencouncil.gr" >> $GITHUB_STEP_SUMMARY
+          fi
 
       - name: Health check
         id: health-check
@@ -263,6 +299,7 @@ jobs:
             const healthStatus = '${{ steps.health-check.outputs.status }}';
             const logsUrl = context.serverUrl + '/' + context.repo.owner + '/' + context.repo.repo + '/actions/runs/' + context.runId;
             const hasMigrations = '${{ needs.check-migrations.outputs.has-migrations }}' === 'true';
+            const linkedTasksPr = '${{ steps.preview-links.outputs.tasks-pr }}';
 
             const dbNote = hasMigrations
               ? '*This preview uses an **isolated database** with seed data (migrations were applied).*'
@@ -271,8 +308,13 @@ jobs:
             let body = '## 🚀 Preview deployment ready!\n\n'
               + '**Preview URL:** ' + previewUrl + '\n'
               + '**Commit:** `' + commitSha + '`\n'
-              + '**Database:** ' + (hasMigrations ? 'Isolated (PostGIS 3.3.5, seed data)' : 'Shared staging') + '\n\n'
-              + 'The preview will be automatically updated when you push new commits.\n'
+              + '**Database:** ' + (hasMigrations ? 'Isolated (PostGIS 3.3.5, seed data)' : 'Shared staging') + '\n';
+
+            if (linkedTasksPr) {
+              body += '**Tasks API:** https://pr-' + linkedTasksPr + '.tasks.opencouncil.gr\n';
+            }
+
+            body += '\nThe preview will be automatically updated when you push new commits.\n'
               + 'It will be destroyed when this PR is closed or merged.\n\n';
 
             if (healthStatus === 'unhealthy') {

flake.nix

@@ -1213,6 +1213,14 @@ EOF
                     fi
                     # Otherwise DATABASE_URL comes from EnvironmentFile (shared staging)
 
+                    # Load per-preview env overrides (e.g., linked tasks preview)
+                    if [ -f "$PR_DIR/.env.local" ]; then
+                      echo "Loading per-preview env from .env.local"
+                      set -a
+                      . "$PR_DIR/.env.local"
+                      set +a
+                    fi
+
                     # Set per-PR URLs at runtime
                     export NEXT_PUBLIC_BASE_URL="https://pr-$PR_NUM.${cfg.previewDomain}"
                     # NEXTAUTH_URL is required for NextAuth to construct correct callback URLs