Switch nginx config to directory mount and add webhook listener

- Move deploy/nginx.conf -> deploy/conf.d/default.conf and mount the
  directory so future config changes can be hot-reloaded with
  `nginx -s reload` instead of a full container restart.
- Add deploy/hook.py: a tiny stdlib HMAC-validated webhook listener that
  runs pull.sh on Gitea push events. Bound to 127.0.0.1:9528 and
  fronted by openresty at /_hook/deploy.
- Add the matching systemd unit at deploy/facere-deploy-hook.service.
- Teach pull.sh the new layout (reload vs. restart vs. compose up -d)
  and self-restart the hook listener if hook.py changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/pull.sh

@@ -8,18 +8,30 @@ if [ "$before" = "$after" ]; then
   exit 0
 fi
 
-# Detect whether the bind-mounted nginx.conf changed in this update.
-# Docker bind-mounts the file by inode, so a `git reset` (which replaces
-# the file) requires a container restart for the new config to take effect.
-nginx_changed=0
-if git diff --name-only "$before" "$after" | grep -qx 'deploy/nginx.conf'; then
-  nginx_changed=1
-fi
+changed=$(git diff --name-only "$before" "$after")
+nginx_conf_changed=0
+compose_changed=0
+hook_changed=0
+if grep -qx 'deploy/conf.d/default.conf' <<<"$changed"; then nginx_conf_changed=1; fi
+if grep -qx 'deploy/docker-compose.yml'   <<<"$changed"; then compose_changed=1;    fi
+if grep -qx 'deploy/hook.py'              <<<"$changed"; then hook_changed=1;       fi
 
 git reset --hard origin/main
 echo "[$(date -Is)] deployed $before -> $after"
 
-if [ "$nginx_changed" = "1" ]; then
-  sudo -n docker restart facere-web >/dev/null
-  echo "[$(date -Is)] restarted facere-web (nginx.conf changed)"
+if [ "$compose_changed" = "1" ]; then
+  ( cd /home/ubuntu/repo/facere-website/deploy && sudo -n docker compose up -d ) >/dev/null
+  echo "[$(date -Is)] docker compose up -d (compose changed)"
+elif [ "$nginx_conf_changed" = "1" ]; then
+  if sudo -n docker exec facere-web nginx -t >/dev/null 2>&1; then
+    sudo -n docker exec facere-web nginx -s reload >/dev/null
+    echo "[$(date -Is)] nginx reloaded (default.conf changed)"
+  else
+    echo "[$(date -Is)] nginx config test FAILED, not reloading" >&2
+  fi
+fi
+
+if [ "$hook_changed" = "1" ]; then
+  sudo -n systemctl restart facere-deploy-hook >/dev/null || true
+  echo "[$(date -Is)] facere-deploy-hook restarted (hook.py changed)"
 fi