Switch nginx config to directory mount and add webhook listener

- Move deploy/nginx.conf -> deploy/conf.d/default.conf and mount the
  directory so future config changes can be hot-reloaded with
  `nginx -s reload` instead of a full container restart.
- Add deploy/hook.py: a tiny stdlib HMAC-validated webhook listener that
  runs pull.sh on Gitea push events. Bound to 127.0.0.1:9528 and
  fronted by openresty at /_hook/deploy.
- Add the matching systemd unit at deploy/facere-deploy-hook.service.
- Teach pull.sh the new layout (reload vs. restart vs. compose up -d)
  and self-restart the hook listener if hook.py changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/docker-compose.yml

@@ -7,4 +7,4 @@ services:
       - "9527:80"
     volumes:
       - ../:/usr/share/nginx/html:ro
-      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./conf.d:/etc/nginx/conf.d:ro