Add deploy webhook receiver for snotes

deploy/deploy.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Deploy script for snotes — git pull, build, restart, health check.
+# Designed to run on the Docker host (ppv.loc, checkout at /root/git/snotes).
+# Can be called directly or triggered by webhook-server.py.
+#
+# Authentication: uses SSH to clone/pull from gitea. For HTTP remotes, create
+#   deploy/deploy.conf with GIT_TOKEN=your_gitea_token_here
+
+REPO_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+COMPOSE_FILE="$REPO_DIR/docker-compose.yml"
+CONFIG_FILE="$(dirname "$0")/deploy.conf"
+HEALTH_URL="http://localhost:8019/api/me"
+MAX_RETRIES=5
+RETRY_DELAY=3
+
+# Load token from config file if present
+if [ -f "$CONFIG_FILE" ]; then
+    # shellcheck source=/dev/null
+    . "$CONFIG_FILE"
+fi
+
+echo "[deploy] Pulling latest code..."
+cd "$REPO_DIR"
+if [ -n "${GIT_TOKEN:-}" ]; then
+    # Inject token into remote URL for this pull only
+    REMOTE_URL=$(git remote get-url origin)
+    if [[ "$REMOTE_URL" != *"${GIT_TOKEN}@"* ]]; then
+        # Replace https:// or http:// with scheme://token@
+        AUTH_URL="${REMOTE_URL/https:\/\//https:\/\/${GIT_TOKEN}@}"
+        AUTH_URL="${AUTH_URL/http:\/\//http:\/\/${GIT_TOKEN}@}"
+        git pull "$AUTH_URL" "$(git rev-parse --abbrev-ref HEAD)"
+    else
+        git pull
+    fi
+else
+    git pull
+fi
+
+echo "[deploy] Building Docker image..."
+docker compose -f "$COMPOSE_FILE" build
+
+echo "[deploy] Restarting container..."
+docker compose -f "$COMPOSE_FILE" down --remove-orphans
+docker compose -f "$COMPOSE_FILE" up -d
+
+echo "[deploy] Health check: $HEALTH_URL"
+for i in $(seq 1 $MAX_RETRIES); do
+    sleep "$RETRY_DELAY"
+    if curl -sf "$HEALTH_URL" > /dev/null 2>&1; then
+        echo "[deploy] OK — healthy"
+        exit 0
+    fi
+    echo "[deploy]   attempt $i/$MAX_RETRIES — not ready yet"
+done
+
+echo "[deploy] FAIL — health check did not pass"
+exit 1