security(deploy): webhook secrets out of git; all exposed ones rotated

deploy/hooks-lxc*.json in this public repo held the HMAC secrets for
every auto-deploy webhook (and 106's cinny-build token), readable
anonymously. Six values had been committed: the four matrix-deploy
secrets, 106's lotus-deploy secret (publicly reachable through
chat.lotusguild.org/hooks/lotus-deploy) and the cinny-build token.

- All six rotated on the servers and in Gitea (matrix hooks 6-9,
  cinny hook 69). The old values are rejected.
- Secrets now live in /etc/webhook/secrets.env (0600) on each LXC, loaded
  by a systemd drop-in that also enables webhook's -template mode; the
  hooks files use {{ getenv "NAME" | js }} placeholders.
- The repo hooks files are now exact copies of the live ones, so they
  also document the *-config-deploy hooks they were missing. Those
  three secrets were never committed and are unchanged.
- README: where the secrets live and how to rotate one.
- CI `hooks-no-secrets` fails if a literal secret lands in a hooks
  file again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

deploy/hooks-lxc106.json

@@ -7,7 +7,7 @@
     "trigger-rule": {
       "match": {
         "type": "payload-hash-sha256",
-        "secret": "76dd5febd1cc3458545ce37537f4bfe26f241a9635b57a2cba183ebc9221230b",
+        "secret": "{{ getenv "MATRIX_DEPLOY_SECRET" | js }}",
         "parameter": {
           "source": "header",
           "name": "X-Gitea-Signature"
@@ -23,7 +23,7 @@
     "trigger-rule": {
       "match": {
         "type": "value",
-        "value": "a82340fc2f07e6afda097494c34aa3a4877924932a0b063a76106fdab9816ec6",
+        "value": "{{ getenv "CINNY_BUILD_TOKEN" | js }}",
         "parameter": {
           "source": "header",
           "name": "X-Build-Token"
@@ -41,7 +41,7 @@
         {
           "match": {
             "type": "payload-hash-sha256",
-            "secret": "7b333a1bf4c02aacece65de00e6d8c3e86881f1254f4efa91aeddb82b67dd50f",
+            "secret": "{{ getenv "LOTUS_DEPLOY_SECRET" | js }}",
             "parameter": {
               "source": "header",
               "name": "X-Gitea-Signature"