Add polling-based auto-deploy: server picks up pushes to master

scripts/auto-deploy.sh + a systemd timer (2min interval) that fetches
origin/master and, if ahead, pulls/rebuilds/migrates/restarts - same
sequence as the manual update steps in DEPLOYMENT.md, just scheduled.
Polling instead of a Gitea webhook deliberately: no extra exposed
service, no Docker socket mounted into a container, no shared secret
to manage - it's the same trust boundary as a manual SSH deploy.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

infrastructure/systemd/ci-agent-deploy.service

@@ -0,0 +1,9 @@
+[Unit]
+Description=CI Agent auto-deploy (poll Gitea for new commits on master)
+After=docker.service
+Requires=docker.service
+
+[Service]
+Type=oneshot
+WorkingDirectory=/opt/ci-agent
+ExecStart=/opt/ci-agent/scripts/auto-deploy.sh