Add Gitea-push webhook for auto-deploy

webhook.py: HMAC-signed receiver (X-Gitea-Signature), validates ref==main,
  one-concurrent-deploy lock, no request data reaches shell.
deploy-webhook.sh: installs llm-bench-webhook systemd service (runs as
  aygea, in docker group), generates + stores secret in .webhook.secret.
deploy.sh: port read from compose (now 31415).

Installed on mewtwo: listening 0.0.0.0:41798, enabled for boot.
Gitea webhook target: http://10.0.0.22:41798/hook

Co-Authored-By: Claude <noreply@anthropic.com>

deploy.sh

@@ -16,8 +16,10 @@ case "${1:-up}" in
     # --build forces a rebuild so new grades/code take effect
     docker compose up -d --build
     echo
-    echo "✓ dashboard up: http://$(hostname -I 2>/dev/null | awk '{print $1}' || echo localhost):8081/dashboard.html"
-    echo "  (bind 0.0.0.0:8081 -> container :80)"
+    PORT=$(grep -oP '0\.0\.0\.0:\K[0-9]+' docker-compose.yml | head -1)
+    HOSTIP=$(hostname -I 2>/dev/null | awk '{print $1}' || echo localhost)
+    echo "✓ dashboard up: http://${HOSTIP}:${PORT}/dashboard.html"
+    echo "  (bind 0.0.0.0:${PORT} -> container :80)"
     ;;
   logs)   docker compose logs -f --tail=100 ;;
   down)   docker compose down ;;