fix: scope all Vercel secret names per-project

Use VERCEL_WEBSITE_TOKEN and VERCEL_WEBSITE_ORG_ID instead of shared
names. Convention: VERCEL_<PROJECT>_* for future multi-project support.

.github/workflows/ci-vercel-website-preview.yaml

@@ -0,0 +1,91 @@
+---
+name: 'CI: Vercel Website Preview'
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - 'apps/website/**'
+      - 'packages/design-system/**'
+      - 'packages/tailwind-utils/**'
+  push:
+    branches: [main]
+    paths:
+      - 'apps/website/**'
+      - 'packages/design-system/**'
+      - 'packages/tailwind-utils/**'
+
+env:
+  VERCEL_ORG_ID: ${{ secrets.VERCEL_WEBSITE_ORG_ID }}
+  VERCEL_PROJECT_ID: ${{ secrets.VERCEL_WEBSITE_PROJECT_ID }}
+
+jobs:
+  deploy-preview:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Install Vercel CLI
+        run: npm install --global vercel@latest
+
+      - name: Pull Vercel environment information
+        run: vercel pull --yes --environment=preview --token=${{ secrets.VERCEL_WEBSITE_TOKEN }}
+
+      - name: Build project artifacts
+        run: vercel build --token=${{ secrets.VERCEL_WEBSITE_TOKEN }}
+
+      - name: Deploy project artifacts to Vercel
+        id: deploy
+        run: |
+          URL=$(vercel deploy --prebuilt --token=${{ secrets.VERCEL_WEBSITE_TOKEN }})
+          echo "url=$URL" >> "$GITHUB_OUTPUT"
+
+      - name: Comment preview URL on PR
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const body = `**Website Preview:** ${process.env.PREVIEW_URL}`
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            })
+            const existing = comments.find(
+              (c) => c.user?.type === 'Bot' && c.body?.includes('**Website Preview:**')
+            )
+            const params = {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body,
+            }
+            if (existing) {
+              await github.rest.issues.updateComment({ ...params, comment_id: existing.id })
+            } else {
+              await github.rest.issues.createComment({ ...params, issue_number: context.issue.number })
+            }
+        env:
+          PREVIEW_URL: ${{ steps.deploy.outputs.url }}
+
+  deploy-production:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Install Vercel CLI
+        run: npm install --global vercel@latest
+
+      - name: Pull Vercel environment information
+        run: vercel pull --yes --environment=production --token=${{ secrets.VERCEL_WEBSITE_TOKEN }}
+
+      - name: Build project artifacts
+        run: vercel build --prod --token=${{ secrets.VERCEL_WEBSITE_TOKEN }}
+
+      - name: Deploy project artifacts to Vercel
+        run: vercel deploy --prebuilt --prod --token=${{ secrets.VERCEL_WEBSITE_TOKEN }}

apps/website/vercel.json

@@ -0,0 +1,5 @@
+{
+  "github": {
+    "enabled": false
+  }
+}