feat: add /deploy-plugins webhook route + deploy-plugins script

scripts/seed-secrets.sh

@@ -50,7 +50,10 @@ seed_key() {
 }
 
 mcp_token="$(get_container_env api OIKOS_MCP_BEARER_TOKEN)"
-openrouter_key="$(get_container_env nomos OPENROUTER_API_KEY)"
+# OPENROUTER_API_KEY used to come from the nomos container's env; nomos is
+# decommissioned (dsh is the agent runtime now) and reads the key straight
+# from Infisical, so seed from the deploying host's environment.
+openrouter_key="${OPENROUTER_API_KEY:-}"
 webhook_hmac="$(get_container_env api WEBHOOK_HMAC_SECRET 2>/dev/null)"
 
 api_token="$mcp_token"