Add Gitea-push webhook for auto-deploy

webhook.py: HMAC-signed receiver (X-Gitea-Signature), validates ref==main,
  one-concurrent-deploy lock, no request data reaches shell.
deploy-webhook.sh: installs llm-bench-webhook systemd service (runs as
  aygea, in docker group), generates + stores secret in .webhook.secret.
deploy.sh: port read from compose (now 31415).

Installed on mewtwo: listening 0.0.0.0:41798, enabled for boot.
Gitea webhook target: http://10.0.0.22:41798/hook

Co-Authored-By: Claude <noreply@anthropic.com>

.gitignore

@@ -18,3 +18,6 @@ __pycache__/
 .env
 .env.*
 *.local
+
+# --- Webhook secret (NEVER commit) ---
+.webhook.secret