Harden the Jenkins deploy pipeline

A few rough edges in the Jenkinsfile:

• SSH uses StrictHostKeyChecking=no on every hop, so the deploy would happily talk to an impostor host. Pre-populate known_hosts on the Jenkins agent or use accept-new
• The deploy does rm -rf on the whole target dir and re-copies everything each time. Copy the files into place instead so a failed copy doesn't leave an empty deploy dir
• The staging DB restore is inline shell in the Jenkinsfile, pull it into a script in the repo so it's versioned and readable