fix: normalize CRLF in deploy .env and safe env merge helper

Prevent Fineract connection failures when .env is uploaded from Windows, and add merge-env-fragment.sh to update keys without wiping existing vars.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/deployment/deploy-omnl-bank-production.sh

@@ -31,6 +31,11 @@ export OMNL_SUPPORTED_CHAINS_CONFIG="${OMNL_SUPPORTED_CHAINS_CONFIG:-$REPO_DIR/c
 export OMNL_M2_TOKEN_REGISTRY="${OMNL_M2_TOKEN_REGISTRY:-$REPO_DIR/config/omnl-m2-token-registry.v1.json}"
 
 if [ -f "$ENV_FILE" ]; then
+  if grep -q $'\r' "$ENV_FILE" 2>/dev/null; then
+    log "Normalizing CRLF line endings in $ENV_FILE"
+    tr -d '\r' <"$ENV_FILE" >"${ENV_FILE}.lf" && mv "${ENV_FILE}.lf" "$ENV_FILE"
+    chmod 600 "$ENV_FILE"
+  fi
   set -a
   # shellcheck disable=SC1090
   source "$ENV_FILE"
@@ -78,6 +83,7 @@ start_svc() {
     OMNL_API_KEY="${OMNL_API_KEY:-}" \
     OMNL_FINERACT_BASE_URL="${OMNL_FINERACT_BASE_URL:-${FINERACT_BASE_URL:-}}" \
     OMNL_FINERACT_TENANT="${OMNL_FINERACT_TENANT:-${FINERACT_TENANT:-omnl}}" \
+    OMNL_FINERACT_USER="${OMNL_FINERACT_USER:-}" \
     OMNL_FINERACT_USERNAME="${OMNL_FINERACT_USERNAME:-}" \
     OMNL_FINERACT_PASSWORD="${OMNL_FINERACT_PASSWORD:-}" \
     OMNL_PUBLIC_MONEY_SUPPLY="${OMNL_PUBLIC_MONEY_SUPPLY:-1}" \

scripts/deployment/merge-env-fragment.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Merge KEY=VALUE lines from a fragment file into target .env (replace existing keys).
+set -euo pipefail
+
+TARGET="${1:?target .env path}"
+FRAGMENT="${2:?fragment file path}"
+
+touch "$TARGET"
+tmp="$(mktemp)"
+if [[ -f "$TARGET" ]]; then
+  cp "$TARGET" "$tmp"
+else
+  : > "$tmp"
+fi
+
+while IFS= read -r line || [[ -n "$line" ]]; do
+  line="${line//$'\r'/}"
+  [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]] && continue
+  key="${line%%=*}"
+  [[ "$key" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
+  grep -v "^${key}=" "$tmp" > "${tmp}.new" || true
+  mv "${tmp}.new" "$tmp"
+  printf '%s\n' "$line" >> "$tmp"
+done < "$FRAGMENT"
+
+if grep -q '^OMNL_FINERACT_USER=' "$tmp" && ! grep -q '^OMNL_FINERACT_USERNAME=' "$tmp"; then
+  u="$(grep '^OMNL_FINERACT_USER=' "$tmp" | cut -d= -f2-)"
+  printf 'OMNL_FINERACT_USERNAME=%s\n' "$u" >> "$tmp"
+fi
+
+mv "$tmp" "$TARGET"
+tr -d '\r' <"$TARGET" >"${TARGET}.lf" && mv "${TARGET}.lf" "$TARGET"
+chmod 600 "$TARGET"