add Gitea webhook cleanup script for apps/105

scripts/cleanup-apps105-webhooks.sh: lists webhooks on dtoro/oikos,
filters for apps/105 deployment endpoints, prompts for confirmation,
deletes matching hooks via Gitea API.

Usage: GITEA_TOKEN='...' ./scripts/cleanup-apps105-webhooks.sh

Also updated cutover-checklist.md with the script reference and LXC
archive command.

scripts/cleanup-apps105-webhooks.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# Remove apps/105 Gitea webhooks from the oikos repo.
+# apps/105 is stopped; its deploy webhook (ids 10, 11) should be removed
+# so pushes no longer trigger deploys to the old Python stack.
+#
+# Usage:
+#   GITEA_TOKEN="<your-token>" ./scripts/cleanup-apps105-webhooks.sh
+#
+# Get a token: git.hubris.network → Settings → Applications → Generate Token
+# Scopes needed: write:repository
+
+set -euo pipefail
+
+GITEA_URL="${GITEA_URL:-https://git.hubris.network}"
+REPO="${REPO:-dtoro/oikos}"
+TOKEN="${GITEA_TOKEN:-}"
+
+if [ -z "$TOKEN" ]; then
+    echo "ERROR: GITEA_TOKEN not set"
+    echo "Usage: GITEA_TOKEN='...' $0"
+    exit 1
+fi
+
+echo "=== Listing webhooks for $REPO ==="
+HOOKS=$(curl -s -H "Authorization: token $TOKEN" \
+    "$GITEA_URL/api/v1/repos/$REPO/hooks")
+
+echo "$HOOKS" | jq -r '.[] | "  id=\(.id) url=\(.config.url) active=\(.active)"'
+
+# Find hooks pointing to apps/105
+APPS105_HOOKS=$(echo "$HOOKS" | jq -r '.[] | select(.config.url | test("apps105|192.168.8.105")) | .id')
+
+if [ -z "$APPS105_HOOKS" ]; then
+    echo ""
+    echo "No apps/105 webhooks found. Nothing to do."
+    exit 0
+fi
+
+echo ""
+echo "=== Found apps/105 webhooks ==="
+for id in $APPS105_HOOKS; do
+    URL=$(echo "$HOOKS" | jq -r ".[] | select(.id == $id) | .config.url")
+    echo "  Hook $id → $URL"
+done
+
+echo ""
+read -p "Delete these webhooks? [y/N] " CONFIRM
+
+if [ "$CONFIRM" != "y" ] && [ "$CONFIRM" != "Y" ]; then
+    echo "Aborted."
+    exit 0
+fi
+
+for id in $APPS105_HOOKS; do
+    echo "Deleting hook $id..."
+    RESP=$(curl -s -w "%{http_code}" -o /dev/null \
+        -X DELETE \
+        -H "Authorization: token $TOKEN" \
+        "$GITEA_URL/api/v1/repos/$REPO/hooks/$id")
+    if [ "$RESP" = "204" ]; then
+        echo "  ✓ Hook $id deleted"
+    else
+        echo "  ✗ Hook $id: HTTP $RESP"
+    fi
+done
+
+echo ""
+echo "=== Done ==="

scripts/cutover-checklist.md

@@ -35,6 +35,8 @@ Status: [x] = done, [ ] = pending
 
 ## Cleanup
 
-- [ ] Remove Gitea webhooks for apps/105 (ids 10, 11) from `dtoro/Homelab-Docs`
+- [ ] Remove Gitea webhooks for apps/105 (ids 10, 11) from `dtoro/oikos`
+    → Run: `GITEA_TOKEN="<token>" ./scripts/cleanup-apps105-webhooks.sh`
 - [ ] Archive apps/105 LXC (keep for 30 days, then destroy)
+    → `ssh hubris pct stop 105 && pct snapshot 105 archive-$(date +%Y%m%d)`
 - [x] Update auto-deploy docs — apps/105 entries marked deprecated