feat: auto-deploy tagged releases to CT 126 via signed webhook (0.3.1)

CI's new deploy job (tags only) sends the house HMAC webhook to CT 126; the
listener runs /usr/lib/devdesk/devdesk-deploy, which waits for the version in
the apt registry and upgrades devdesk with --force-confold. Running sessions
are untouched. Hook setup is documented in docs/DEPLOY.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/DEPLOY.md

@@ -36,7 +36,30 @@ Then run `authelia validate-config --config /etc/authelia/configuration.yml && s
 - **Cloudflare:** add a CNAME `dev` → apex, DNS-only (grey cloud).
 - **Pi-hole:** add `"10.10.10.27 dev.lotusguild.org"` to `dns.hosts` in `pve-infra/containers/163-pihole/etc/pihole/pihole.toml`. A push auto-deploys it, and LAN clients then reach NPM directly instead of hairpinning.
 
-## 5. Optional hardening
+## 5. Auto-deploy on release
+A `v*` tag makes CI publish the package, then send a signed webhook (the house HMAC pattern) to CT 126's existing `webhook` listener on :9000. The listener runs `/usr/lib/devdesk/devdesk-deploy <ref>`, which waits for that version in the apt registry and upgrades only `devdesk` with `--force-confold`. Running Claude sessions are untouched. The log is `/var/log/devdesk-deploy.log`.
+
+**Setup, done once:**
+1. Generate a secret.
+2. Add this hook to `/etc/webhook/hooks.json`, next to `126-config-deploy`. The file is local and untracked because it holds secrets.
+   ```json
+   {
+     "id": "devdesk-deploy",
+     "execute-command": "/usr/lib/devdesk/devdesk-deploy",
+     "command-working-directory": "/",
+     "pass-arguments-to-command": [{"source": "payload", "name": "ref"}],
+     "trigger-rule": {"and": [
+       {"match": {"type": "payload-hash-sha256", "secret": "<WEBHOOK_SECRET>",
+                  "parameter": {"source": "header", "name": "X-Gitea-Signature"}}},
+       {"match": {"type": "regex", "regex": "^refs/tags/v[0-9]+\\.[0-9]+\\.[0-9]+$",
+                  "parameter": {"source": "payload", "name": "ref"}}}
+     ]}
+   }
+   ```
+3. Run `systemctl restart webhook`.
+4. Store the same secret as the devdesk repo's Actions secret `WEBHOOK_SECRET`.
+
+## 6. Optional hardening
 Enable the Proxmox firewall on CT 126 (`firewall=1` on net0) and allow tcp/7681 only from 10.10.10.27. The same rule suits code-server on :8680.
 
 ## Operations