deploy.sh runs on LXC 121: git pull, caddy validate, systemctl reload.
webhook.py is a small HTTP receiver on :9797/deploy that verifies the
gitea HMAC-SHA256 signature and triggers deploy.sh.
install.sh provisions /etc/caddy-deploy/secret and the systemd unit.
