fix: address PR review — unknown flag guard, local var scope, container map

- Reject unknown --flags with error instead of silently treating as commit SHA
- Declare remote_hash as local to prevent stale values across loop iterations
- Use associative array for container names (consistent with DEPLOY_HOST pattern)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/deploy.sh

@@ -56,6 +56,10 @@ while [[ $# -gt 0 ]]; do
       SYNC_TEMPLATES=true
       shift
       ;;
+    --*)
+      echo -e "${RED}Unknown option: $1${NC}"
+      usage
+      ;;
     *)
       COMMIT="$1"
       shift
@@ -93,7 +97,7 @@ check_templates() {
   local changed=()
   local missing_remote=()
   while IFS= read -r line; do
-    local hash file
+    local hash file remote_hash
     hash=$(echo "$line" | awk '{print $1}')
     file=$(echo "$line" | awk '{print $2}')
     remote_hash=$(echo "$remote_hashes" | awk -v f="$file" '$2 == f {print $1}')
@@ -131,14 +135,11 @@ check_templates() {
 check_templates
 
 # --- Cached image report ---
+declare -A API_CONTAINER=([dev]="dev_pd_database" [prod]="pd_api")
+
 report_cache() {
   local host="${DEPLOY_HOST[$ENV]}"
-  local container
+  local container="${API_CONTAINER[$ENV]}"
-  if [[ "$ENV" == "dev" ]]; then
-    container="dev_pd_database"
-  else
-    container="pd_api"
-  fi
 
   echo -e "${CYAN}Cached card images on ${host} (${container}):${NC}"
   ssh "$host" "