feat: add deploy-to command and reorganize ssh config + docs

- dotfiles_manager.sh: add 'deploy-to' command to SCP tracked dotfiles
  and scripts directly to servers with no Gitea access
  - backs up existing remote files to ~/.dotfiles_backup/remote-<host>-<timestamp>/
    before overwriting anything
  - flags: --scripts-only, --include-ssh, --no-backup, --dry-run
- ssh/config: reorganize into labeled sections, move work hosts to top,
  fix global defaults (proper Host * block, remove deprecated Protocol/KeepAlive),
  add inline comments on all port forwards
- README.md: full rewrite with directory layout, profiles, shell layering,
  env vars, aliases, bootstrap flow, symlink mechanics, SSH key strategy,
  two-machine sync workflow, and deploy-to docs

README.md

@@ -195,15 +195,20 @@ source ~/.bash_profile
 
 ### Day-to-day sync
 
+After editing on one machine, push and sync on the other:
+
 ```bash
-# Pull latest dotfiles from Gitea and reapply any new symlinks:
-dotfiles sync          # or: bash ~/scripts/bootstrap.sh
+# On the machine where you made changes:
+dotfiles push "describe what changed"
 
-# Push local changes:
-dotfiles push "my change description"
+# On the other machine to pick up the changes:
+dotfiles sync
+```
 
-# Check symlink health:
-dotfiles status
+```bash
+# Other useful commands:
+dotfiles status        # check symlink health
+dotfiles sync          # pull + rebase + reapply symlinks (also callable as: bash ~/scripts/bootstrap.sh)
 ```
 
 ### Remote machine bootstrap (from this machine)
@@ -215,6 +220,35 @@ dotfiles remote-bootstrap user@hostname --profile work
 
 This uploads the scripts, then runs the full setup interactively over SSH.
 
+### Deploy to a server with no Gitea access
+
+Linux servers at work can't clone the private Gitea repo. Use `deploy-to` to
+SCP tracked dotfiles and scripts directly to their HOME paths — no git required
+on the remote.
+
+```bash
+# Push everything (dotfiles + scripts):
+dotfiles deploy-to user@server
+
+# Scripts only (dotfiles_manager.sh, bootstrap.sh, setup script):
+dotfiles deploy-to user@server --scripts-only
+
+# Preview what would be transferred without doing it:
+dotfiles deploy-to user@server --dry-run
+
+# Also deploy ~/.ssh/config (skipped by default for security):
+dotfiles deploy-to user@server --include-ssh
+
+# Skip the pre-deploy backup (faster, but no safety net):
+dotfiles deploy-to user@server --no-backup
+```
+
+Before overwriting any file, `deploy-to` SCPs the server's existing versions
+to `~/.dotfiles_backup/remote-<host>-<timestamp>/` on your local machine.
+Files are copied directly (not symlinked). Re-run `deploy-to` any time you
+want to push updates. `~/.ssh/` is skipped by default to avoid accidentally
+pushing private keys or your personal known_hosts to a shared server.
+
 ---
 
 ## Dotfiles Management — How Symlinks Work