Add Authorization-header + /hook proxy to webhook/deploy

webhook.py: check_auth() requires Bearer token (WEBHOOK_AUTH_TOKEN),
  checked before HMAC signature. Returns 401 on missing auth.
Dockerfile: nginx proxies /hook -> host:41798, forwarding Authorization
  + X-Gitea-Signature headers. Host IP via HOST_IP env + host-gateway.
docker-compose.yml: extra_hosts host-gateway + HOST_IP env.
deploy-webhook.sh: generates .webhook.auth token, 'auth' subcommand.

Co-Authored-By: Claude <noreply@anthropic.com>

Dockerfile

@@ -5,17 +5,33 @@ WORKDIR /app
 COPY . .
 RUN python3 generate_dashboard.py
 
-# Serve stage: nginx serves the generated static files.
+# Serve stage: nginx serves static files + proxies /hook to the host webhook receiver.
 FROM nginx:alpine
-# Replace the default nginx server block so root redirects to the dashboard
 RUN printf '%s\n' \
     'server {' \
     '    listen 80;' \
     '    server_name _;' \
     '    root /usr/share/nginx/html;' \
     '    index dashboard.html;' \
+    '    client_max_body_size 2m;' \
     '    location = / { return 302 /dashboard.html; }' \
-    '}' > /etc/nginx/conf.d/default.conf
+    '    location /hook {' \
+    '        proxy_pass http://__HOST_IP__:41798;' \
+    '        proxy_set_header Host $host;' \
+    '        proxy_set_header Authorization $http_authorization;' \
+    '        proxy_set_header X-Gitea-Signature $http_x_gitea_signature;' \
+    '        proxy_set_header X-Gitea-Event $http_x_gitea_event;' \
+    '        proxy_set_header X-Gitea-Event-Type $http_x_gitea_event_type;' \
+    '        proxy_set_header Content-Type $content_type;' \
+    '        proxy_read_timeout 60s;' \
+    '    }' \
+    '}' > /etc/nginx/conf.d/default.conf.template
 COPY --from=build /app/dashboard.html /usr/share/nginx/html/dashboard.html
 COPY --from=build /app/pages         /usr/share/nginx/html/pages
+RUN printf '%s\n' '#!/bin/sh' 'set -e' \
+    'HOST_IP="${HOST_IP:-host.docker.internal}"' \
+    'sed "s|__HOST_IP__|${HOST_IP}|g" /etc/nginx/conf.d/default.conf.template > /etc/nginx/conf.d/default.conf' \
+    'exec nginx -g "daemon off;"' > /docker-entrypoint-hostip.sh \
+    && chmod +x /docker-entrypoint-hostip.sh
 EXPOSE 80
+ENTRYPOINT ["/docker-entrypoint-hostip.sh"]