security(deploy): webhook secrets out of git; all exposed ones rotated

deploy/hooks-lxc*.json in this public repo held the HMAC secrets for
every auto-deploy webhook (and 106's cinny-build token), readable
anonymously. Six values had been committed: the four matrix-deploy
secrets, 106's lotus-deploy secret (publicly reachable through
chat.lotusguild.org/hooks/lotus-deploy) and the cinny-build token.

- All six rotated on the servers and in Gitea (matrix hooks 6-9,
  cinny hook 69). The old values are rejected.
- Secrets now live in /etc/webhook/secrets.env (0600) on each LXC, loaded
  by a systemd drop-in that also enables webhook's -template mode; the
  hooks files use {{ getenv "NAME" | js }} placeholders.
- The repo hooks files are now exact copies of the live ones, so they
  also document the *-config-deploy hooks they were missing. Those
  three secrets were never committed and are unchanged.
- README: where the secrets live and how to rotate one.
- CI `hooks-no-secrets` fails if a literal secret lands in a hooks
  file again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

.gitea/workflows/lint.yml

@@ -31,6 +31,21 @@ jobs:
       - name: Run ESLint
         run: npx eslint --ext .js hookshot/
 
+  hooks-no-secrets:
+    name: No secrets in webhook configs
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      # deploy/hooks-*.json are public; their secrets come from
+      # /etc/webhook/secrets.env on each LXC via `{{ getenv "..." }}`.
+      - name: Reject literal secrets
+        run: |
+          if grep -nE '[0-9a-fA-F]{32,}' deploy/hooks-*.json; then
+            echo "::error::A literal secret/token is committed in deploy/hooks-*.json. Use {{ getenv \"NAME\" | js }} and put the value in /etc/webhook/secrets.env on the LXC."
+            exit 1
+          fi
+
   python-lint:
     name: Python (ruff)
     runs-on: ubuntu-latest