feat: add /deploy-plugins webhook route + deploy-plugins script

internal/httpapi/server.go

@@ -16,9 +16,7 @@ import (
 	"log/slog"
 	"math/big"
 	"net/http"
-	"net/http/httputil"
 	"net/url"
-	"os"
 	"strings"
 	"sync"
 	"time"
@@ -350,16 +348,6 @@ func NewHandler(ctx context.Context, pool *db.Pool, cfg config.Config, entities
 	}
 	r.With(combinedAuth(cfg, false)).Handle("/mcp", mcphandler.NewHandler(pool, cfg.MCPBearerToken, nomosAgentID, s.secretsManager, s.entities, s.relService, s.execSvc))
 
-	if nomosURL := os.Getenv("NOMOS_PROXY_URL"); nomosURL != "" {
-		target, _ := url.Parse(nomosURL)
-		proxy := httputil.NewSingleHostReverseProxy(target)
-		// Was unauthenticated (pre-existing gap, predates the client/server
-		// split — this mount was never wrapped in combinedAuth, unlike every
-		// other custom route below). Harmless while dev-open was in effect;
-		// a real hole now that every route needs a real credential.
-		r.Mount("/agent", combinedAuth(cfg, false)(http.StripPrefix("/agent", proxy)))
-	}
-
 	return r
 }