Generic host/repo/branch-aware CD on adnanh/webhook

Replaces the per-project deploy scripts and self-contained webhook
receivers with one manifest-driven implementation that lives outside the
application repositories and can be updated independently of them.

First targets: domaindingo test and prod on s5.

secrets.env.example

@@ -0,0 +1,12 @@
+# Host-local webhook secrets. NEVER commit the real file.
+#
+# Copy to ~/.config/cd-webhook/secrets.env, chmod 600, and set one value per
+# repository this host deploys. Each value must match the "Secret" field of the
+# corresponding webhook in Gitea (Repository -> Settings -> Webhooks).
+#
+# Variable name: CD_WEBHOOK_SECRET_ + the repo path, uppercased, non-alphanumerics
+# collapsed to underscores.  webdev/domaindingo -> CD_WEBHOOK_SECRET_WEBDEV_DOMAINDINGO
+#
+# Generate one with:  openssl rand -hex 32
+
+CD_WEBHOOK_SECRET_WEBDEV_DOMAINDINGO=