Add polling-based auto-deploy: server picks up pushes to master

scripts/auto-deploy.sh + a systemd timer (2min interval) that fetches
origin/master and, if ahead, pulls/rebuilds/migrates/restarts - same
sequence as the manual update steps in DEPLOYMENT.md, just scheduled.
Polling instead of a Gitea webhook deliberately: no extra exposed
service, no Docker socket mounted into a container, no shared secret
to manage - it's the same trust boundary as a manual SSH deploy.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

DEPLOYMENT.md

@@ -106,6 +106,8 @@ Also set `LLM_PROVIDER=anthropic` and `SEARCH_PROVIDER=brave` in `.env` (restart
 
 ## 8. Updating the deployment
 
+Manually:
+
 ```bash
 git pull
 docker compose -f docker-compose.prod.yml build api worker beat web
@@ -113,6 +115,17 @@ docker compose -f docker-compose.prod.yml run --rm api alembic upgrade head
 docker compose -f docker-compose.prod.yml up -d
 ```
 
+**Or automatically**: `scripts/auto-deploy.sh` runs exactly that sequence, gated on "is `origin/master` ahead of `HEAD`" so it's a no-op most runs. Install it as a systemd timer (polls every 2 minutes — deliberately polling, not a Gitea webhook, so there's no extra exposed service, no Docker-socket-in-a-container, and no shared secret to manage):
+
+```bash
+cp infrastructure/systemd/ci-agent-deploy.service infrastructure/systemd/ci-agent-deploy.timer /etc/systemd/system/
+chmod +x scripts/auto-deploy.sh
+systemctl daemon-reload
+systemctl enable --now ci-agent-deploy.timer
+```
+
+Once running, pushing to `master` on Gitea is enough — the server picks it up within ~2 minutes, no manual SSH step needed. Check `journalctl -u ci-agent-deploy.service` to see deploy runs.
+
 ## 9. Backups
 
 Nothing backs itself up by default. At minimum, a nightly cron job on the host: