Register Gitea webhook 14 for oikos-console deploy

Created via the Gitea API (POST /repos/dtoro/Homelab-Docs/hooks) rather
than the UI, since the existing PAT turned out to have sufficient scope.
Webhook id 14: http://192.168.8.205:9831/deploy, push events, main branch
filter, active.

The shared secret was generated and registered with Gitea before the
apps-side bootstrap ran (order reversed from the usual install.sh-first
flow, since direct SSH deploy to apps is still pending operator
execution — see oikos/console/deploy/README.md). Stored as
secrets/oikos-console-deploy-secret.yaml (SOPS, recipient: apps only)
rather than left as a local plaintext file, with explicit operator
sign-off. When the apps-side install runs, skip webhook/install.sh's
random-secret generation and write this exact value into
/etc/oikos-console-deploy/secret instead.

infrastructure/auto-deploy.md updated with the real webhook id (was
"not yet registered").

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

oikos/console/deploy/README.md

@@ -8,33 +8,48 @@ for the general pattern; webhook ids 10 (homelab-mcp, :9811) and 11
 (secrets-issuance, :9821) are the direct precedent — this is a third
 webhook on `dtoro/Homelab-Docs`, port :9831.
 
+## Status (2026-07-06)
+
+- **Gitea webhook: done.** Registered via the Gitea API as webhook id
+  **14** (`http://192.168.8.205:9831/deploy`, `push` events, `main`
+  branch filter, active). See
+  [infrastructure/auto-deploy.md](../../../infrastructure/auto-deploy.md).
+- **Console deploy on apps (105): not yet done.** Direct SSH bootstrap
+  was withheld pending explicit operator execution — see "One-time
+  setup" below. **Important:** webhook 14's secret was generated and
+  registered with Gitea *before* the apps-side install (order reversed
+  from the usual flow). It's encrypted at `secrets/oikos-console-deploy-secret.yaml`
+  (recipient: apps only). When you run `webhook/install.sh` below,
+  **skip its random-secret generation** — instead run
+  `homelab secret oikos-console-deploy-secret` on apps and write the
+  `webhook_secret` value into `/etc/oikos-console-deploy/secret` yourself.
+- **Caddy route: not yet done.**
+- **DNS entry: not yet done.**
+
 ## One-time setup on apps (105)
 
 ```bash
 git clone https://git.hubris.network/dtoro/Homelab-Docs.git /opt/oikos-console
 cd /opt/oikos-console
 ./oikos/console/deploy/deploy.sh                 # first install
-./oikos/console/deploy/webhook/install.sh        # generates the deploy secret, prints it
+./oikos/console/deploy/webhook/install.sh        # generates a NEW secret by default —
+                                                  # see "Status" above before running this
 systemctl enable --now oikos-console.service oikos-console-deploy.service
 ```
 
-Then register the Gitea webhook (`dtoro/Homelab-Docs` → Settings →
-Webhooks) with the URL/secret `install.sh` printed, same as webhooks 10/11.
-
 ## Caddy route — NOT in this repo, needs manual addition to `dtoro/caddy-conf`
 
-The console binds `127.0.0.1:8091` only (see `oikos-console.service` —
-`ProtectSystem=strict`, no LAN listener). Caddy on LXC 121 needs a new
-site block proxying to it, forward-auth gated the same way
-`paperless`/other LAN-only services are (via the shared `(authentik)`
-snippet referenced in
-[containers/106-auth-outpost.md](../../../containers/106-auth-outpost.md)).
-Confirm the exact snippet name/import syntax against the live
-`dtoro/caddy-conf` repo — this is the shape, not verified against it:
+The console binds `127.0.0.1:8091` on apps only (see `oikos-console.service` —
+`ProtectSystem=strict`, no LAN listener); Caddy on LXC 121 reaches it via
+apps' **LAN IP**, not loopback (they're different hosts). Site block,
+forward-auth gated the same way other LAN-only services are (confirmed
+syntax per `containers/121-caddy.md`: `import authentik`, no parens in
+the import statement itself — the snippet is *defined* as `(authentik)`
+but *imported* as `authentik`):
 
 ```caddyfile
 oikos.hubris.network {
-    import (authentik)
+    import authentik
     reverse_proxy 192.168.8.205:8091
 }
 ```