fix(add-page-by-form): patch Grav-2.0 edit-mode header fatal + deploy wiring

Adding a new photo while editing an entry 500s: add-page-by-form's edit branch
reads existing frontmatter via `(array)$page->header()`, but Grav 2.0's
Grav\Common\Page\Header keeps data in a protected `items`, so the cast mangles
keys and `$original_frontmatter['photos']` is never set → array_merge(null,…)
TypeError. Fix: use Header::toArray() (clean keys, stdClass fallback) + guard the
per-field merge. Grav 2.0.7 does not change this — only the plugin fix does.

add-page-by-form is abandoned upstream (last release 2023-09) and its dir is
git-ignored/GPM-managed, so the fix is tracked as deploy/patches/*.patch and
re-applied after any GPM install/update:
- make apply-plugin-patches (local) — chained into install-plugins
- make remote-apply-plugin-patches-{test,prod} — piped over SSH into
  `patch -p1 --forward`; chained into remote-install-plugins / remote-update-plugins
Content syncs don't touch user/plugins/, so the patch survives them; only a GPM
op wipes it (now auto-restored). Runbook + README document the step and a
verify check. Remove once the plugin is forked.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Makefile

@@ -27,7 +27,8 @@ REMOTE_TARGETS := remote-env-setup remote-env-remove remote-wipe remote-install
 	remote-fetch remote-fetch-content remote-install-plugins remote-update-plugins \
 	remote-upgrade-grav remote-git-sync-disable remote-git-sync-enable \
 	remote-content-status remote-clean remote-diag remote-apply-env \
-	remote-gpm-install remote-maintenance-on remote-maintenance-off
+	remote-gpm-install remote-maintenance-on remote-maintenance-off \
+	remote-apply-plugin-patches
 ENVS := test prod
 
 guard-env:
@@ -89,6 +90,19 @@ fix-perms:
 
 install-plugins:
 	docker exec -w /var/www/html intotheeast_grav php bin/gpm install $(shell cat plugins.txt | tr '\n' ' ') -y
+	$(MAKE) apply-plugin-patches
+
+# Re-apply local fixes to git-ignored, GPM-managed third-party plugins. Run this
+# AFTER install-plugins (which overwrites them). See deploy/patches/README.md.
+apply-plugin-patches:
+	@for p in deploy/patches/*.patch; do \
+	  [ -f "$$p" ] || continue; \
+	  if git apply --check "$$p" >/dev/null 2>&1; then \
+	    git apply "$$p" && echo "applied $$p"; \
+	  else \
+	    echo "skipped $$p (already applied or does not match)"; \
+	  fi; \
+	done
 
 # ── Demo content ──────────────────────────────────────────────────────────────
 
@@ -159,9 +173,24 @@ remote-fetch-content: guard-env
 
 remote-install-plugins: guard-env
 	$(SSH) "cd $(WEBROOT) && php bin/gpm index -f && php bin/gpm install $(shell cat plugins.txt | tr '\n' ' ') -y"
+	$(MAKE) remote-apply-plugin-patches
 
 remote-update-plugins: guard-env
 	$(SSH) "cd $(WEBROOT) && php bin/gpm update -y && php bin/grav cache"
+	$(MAKE) remote-apply-plugin-patches
+
+# Re-apply local fixes to git-ignored, GPM-managed third-party plugins on the
+# remote (pristine after a GPM install/update). Piped over SSH like the git-sync
+# scripts — no scp. `--forward` makes it a no-op when already applied. Runs
+# automatically after remote-install-plugins / remote-update-plugins; safe to run
+# standalone. See deploy/patches/README.md.
+remote-apply-plugin-patches: guard-env
+	@for p in deploy/patches/*.patch; do \
+	  [ -f "$$p" ] || continue; \
+	  echo "remote-apply $$p"; \
+	  $(SSH) "cd $(WEBROOT) && patch -p1 --forward -r - --no-backup-if-mismatch" < "$$p" || echo "  (already applied or no-op)"; \
+	done
+	$(SSH) "cd $(WEBROOT) && php bin/grav clearcache"
 
 remote-upgrade-grav: guard-env
 	$(SSH) "cd $(WEBROOT) && php bin/gpm self-upgrade -y && php bin/grav cache"