Add deploy.sh + webhook receiver

deploy.sh runs on LXC 121: git pull, caddy validate, systemctl reload.
webhook.py is a small HTTP receiver on :9797/deploy that verifies the
gitea HMAC-SHA256 signature and triggers deploy.sh.
install.sh provisions /etc/caddy-deploy/secret and the systemd unit.

scripts/deploy.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+# Pull the latest Caddyfile from this repo and reload caddy.
+# Runs on LXC 121 as root.
+set -euo pipefail
+
+REPO_DIR="${REPO_DIR:-/etc/caddy}"
+
+cd "$REPO_DIR"
+
+echo "[deploy] git pull"
+git pull --ff-only
+
+echo "[deploy] caddy validate"
+caddy validate --config "$REPO_DIR/Caddyfile" >/dev/null
+
+echo "[deploy] systemctl reload caddy"
+systemctl reload caddy
+
+echo "[deploy] done"