feat: playground static site with cursor webhook deploy

Scaffold nginx + deploy-hook stack for playground.schwenk.online,
Gitea cursor workflow, directory-based public/ content, and boka
bootstrap via git clone.

Co-authored-by: Cursor <cursoragent@cursor.com>

compose.yml

@@ -0,0 +1,43 @@
+services:
+
+  playground:
+    image: nginx
+    volumes:
+      - ./public:/usr/share/nginx/html:ro
+      - ./nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./nginx/security-headers.conf:/etc/nginx/conf.d/security-headers.conf:ro
+    container_name: playground
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.playground.rule=Host(`playground.schwenk.online`)"
+      - "traefik.http.routers.playground.entrypoints=websecure"
+      - "traefik.http.routers.playground.tls.certresolver=myresolver"
+    networks:
+      - traefik
+
+  deploy-hook:
+    build: ./deploy-hook
+    user: "${HOST_UID:-1000}:${HOST_GID:-1000}"
+    volumes:
+      - .:/repo
+      - ./hooks:/etc/webhook:ro
+    environment:
+      - WEBHOOK_SECRET=${WEBHOOK_SECRET}
+      - DEPLOY_GIT_TOKEN=${DEPLOY_GIT_TOKEN:-}
+      - DEPLOY_BRANCH=${DEPLOY_BRANCH:-main}
+    container_name: playground-deploy-hook
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.playground-hook.rule=Host(`playground.schwenk.online`) && PathPrefix(`/hooks/`)"
+      - "traefik.http.routers.playground-hook.entrypoints=websecure"
+      - "traefik.http.routers.playground-hook.tls.certresolver=myresolver"
+      - "traefik.http.routers.playground-hook.priority=100"
+      - "traefik.http.services.playground-hook.loadbalancer.server.port=9000"
+    networks:
+      - traefik
+
+networks:
+  traefik:
+    external: true