feat: playground static site with cursor webhook deploy

Scaffold nginx + deploy-hook stack for playground.schwenk.online,
Gitea cursor workflow, directory-based public/ content, and boka
bootstrap via git clone.

Co-authored-by: Cursor <cursoragent@cursor.com>

hooks/deploy.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_DIR="/repo"
+BRANCH="${DEPLOY_BRANCH:-main}"
+REMOTE_URL="${DEPLOY_GIT_URL:-https://gitea.schwenk.online/froxxxy/playground.git}"
+
+if [ ! -d "${REPO_DIR}/.git" ]; then
+  echo "Error: ${REPO_DIR} is not a git repository"
+  exit 1
+fi
+
+git config --global --add safe.directory "${REPO_DIR}"
+cd "${REPO_DIR}"
+
+if [ -n "${DEPLOY_GIT_TOKEN:-}" ]; then
+  auth_url="https://oauth2:${DEPLOY_GIT_TOKEN}@gitea.schwenk.online/froxxxy/playground.git"
+  git pull "${auth_url}" "${BRANCH}"
+else
+  git pull origin "${BRANCH}"
+fi
+
+echo "Deploy pull completed for ${BRANCH}"

hooks/hooks.json.template

@@ -0,0 +1,32 @@
+[
+  {
+    "id": "deploy",
+    "execute-command": "/etc/webhook/deploy.sh",
+    "command-working-directory": "/repo",
+    "include-command-output-in-response": true,
+    "trigger-rule": {
+      "and": [
+        {
+          "match": {
+            "type": "value",
+            "value": "refs/heads/main",
+            "parameter": {
+              "source": "payload",
+              "name": "ref"
+            }
+          }
+        },
+        {
+          "match": {
+            "type": "payload-hmac-sha256",
+            "secret": "${WEBHOOK_SECRET}",
+            "parameter": {
+              "source": "header",
+              "name": "X-Gitea-Signature"
+            }
+          }
+        }
+      ]
+    }
+  }
+]