Switch nginx config to directory mount and add webhook listener

- Move deploy/nginx.conf -> deploy/conf.d/default.conf and mount the
  directory so future config changes can be hot-reloaded with
  `nginx -s reload` instead of a full container restart.
- Add deploy/hook.py: a tiny stdlib HMAC-validated webhook listener that
  runs pull.sh on Gitea push events. Bound to 127.0.0.1:9528 and
  fronted by openresty at /_hook/deploy.
- Add the matching systemd unit at deploy/facere-deploy-hook.service.
- Teach pull.sh the new layout (reload vs. restart vs. compose up -d)
  and self-restart the hook listener if hook.py changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/facere-deploy-hook.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=Facere deploy webhook listener
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=ubuntu
+EnvironmentFile=/etc/facere-deploy.env
+ExecStart=/usr/bin/python3 /home/ubuntu/repo/facere-website/deploy/hook.py
+Restart=on-failure
+RestartSec=3
+StandardOutput=append:/tmp/facere-deploy-hook.log
+StandardError=append:/tmp/facere-deploy-hook.log
+
+[Install]
+WantedBy=multi-user.target