Add deploy.sh + webhook receiver

deploy.sh runs on LXC 121: git pull, caddy validate, systemctl reload.
webhook.py is a small HTTP receiver on :9797/deploy that verifies the
gitea HMAC-SHA256 signature and triggers deploy.sh.
install.sh provisions /etc/caddy-deploy/secret and the systemd unit.

scripts/webhook/caddy-deploy-webhook.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=Caddy-conf deploy webhook
+After=network.target caddy.service
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/python3 /etc/caddy/scripts/webhook/webhook.py
+Restart=on-failure
+RestartSec=2
+User=root
+ProtectSystem=full
+ProtectHome=true
+NoNewPrivileges=true
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target