Add deploy.sh + webhook receiver

deploy.sh runs on LXC 121: git pull, caddy validate, systemctl reload.
webhook.py is a small HTTP receiver on :9797/deploy that verifies the
gitea HMAC-SHA256 signature and triggers deploy.sh.
install.sh provisions /etc/caddy-deploy/secret and the systemd unit.

scripts/webhook/install.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# One-shot installer for the caddy-conf deploy webhook. Run on LXC 121 as root.
+set -euo pipefail
+
+REPO_DIR="${REPO_DIR:-/etc/caddy}"
+SECRET_DIR=/etc/caddy-deploy
+UNIT=caddy-deploy-webhook.service
+
+install -d -m 700 "$SECRET_DIR"
+if [[ ! -s "$SECRET_DIR/secret" ]]; then
+  umask 177
+  openssl rand -hex 32 > "$SECRET_DIR/secret"
+  echo "[install] generated new secret at $SECRET_DIR/secret"
+fi
+
+install -m 644 "$REPO_DIR/scripts/webhook/$UNIT" "/etc/systemd/system/$UNIT"
+systemctl daemon-reload
+systemctl enable --now "$UNIT"
+systemctl status "$UNIT" --no-pager | head -6
+
+echo
+echo "Webhook listening on 0.0.0.0:9797/deploy"
+echo "Secret (configure this in the Gitea webhook):"
+cat "$SECRET_DIR/secret"