ops: fix data/ triple-duplication costing ~24 GB on VPS

astro build resolves the public/data symlink and copies all activity JSON
into dist/; rsync then copied that to the webroot — but nginx already serves
/data/ directly from /var/bincio/data/ via alias, so both copies were dead
weight. Freed 36 GB → 14 GB on the live server.

- post-receive hook: prune dist/data/ before rsync, add --exclude=data/
- docs: update manual rebuild command and nginx comment to match
- serve/server.py: _mb() now uses lstat() to count symlinks at face value
  rather than following them to targets, so admin storage panel no longer
  double-counts _merged/ (which is mostly symlinks into activities/)

docs/deployment/vps.md

@@ -68,8 +68,11 @@ while read oldrev newrev refname; do
   cd $DEPLOY
   ~/.local/bin/uv run bincio render --data-dir $DATA --site-dir $DEPLOY/site
 
+  echo "--- Pruning dist/data (nginx serves /data/ directly from $DATA) ---"
+  rm -rf $DEPLOY/site/dist/data
+
   echo "--- Copying dist to webroot ---"
-  rsync -a --delete $DEPLOY/site/dist/ /var/www/bincio/
+  rsync -a --delete --exclude=data/ $DEPLOY/site/dist/ /var/www/bincio/
 
   echo "--- Restarting API ---"
   systemctl restart bincio || echo "WARNING: bincio service restart failed — check journalctl -u bincio"
@@ -223,7 +226,8 @@ ssh root@<vps> "cd /opt/bincio && uv run bincio extract"
 # rebuild site
 ssh root@<vps> "cd /opt/bincio && \
   uv run bincio render --data-dir /var/bincio/data --site-dir site && \
-  rsync -a --delete site/dist/ /var/www/bincio/"
+  rm -rf site/dist/data && \
+  rsync -a --delete --exclude=data/ site/dist/ /var/www/bincio/"
 ```
 
 ---
@@ -253,6 +257,11 @@ server {
 
     # Data files served live from disk — bypasses the build/rsync cycle
     # so uploads and merges are visible immediately without a site rebuild.
+    #
+    # IMPORTANT: because nginx owns /data/ here, the post-receive hook must
+    # delete dist/data/ before rsyncing to the webroot. Otherwise astro build
+    # copies all activity JSON (GBs) into dist/ and rsync duplicates it again.
+    # The hook already does this; manual rebuilds must do the same.
     location /data/ {
         alias /var/bincio/data/;
         add_header Cache-Control "no-cache, must-revalidate";