Add Authorization-header + /hook proxy to webhook/deploy

webhook.py: check_auth() requires Bearer token (WEBHOOK_AUTH_TOKEN),
  checked before HMAC signature. Returns 401 on missing auth.
Dockerfile: nginx proxies /hook -> host:41798, forwarding Authorization
  + X-Gitea-Signature headers. Host IP via HOST_IP env + host-gateway.
docker-compose.yml: extra_hosts host-gateway + HOST_IP env.
deploy-webhook.sh: generates .webhook.auth token, 'auth' subcommand.

Co-Authored-By: Claude <noreply@anthropic.com>

docker-compose.yml

@@ -1,13 +1,12 @@
 services:
   benchmark:
-    # Builds from the repo's Dockerfile:
-    #   stage 1 (python) runs generate_dashboard.py from data/benchmark_history.json
-    #   stage 2 (nginx) serves dashboard.html + pages/ as static
     build: .
     image: llm-benchmark:latest
     container_name: llm-benchmark
     restart: unless-stopped
     ports:
-      - "0.0.0.0:31415:80"  # bind all interfaces:31415 -> container :80 (obscure port; Netbird proxies in front)
-    # Re-tag the image so `docker compose up` after a code change rebuilds it.
-    # (compose detects Dockerfile/context changes and rebuilds automatically.)
+      - "0.0.0.0:31415:80"  # all interfaces:31415 -> container :80 (Netbird proxies in front)
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    environment:
+      - HOST_IP=host.docker.internal