Add polling-based auto-deploy: server picks up pushes to master

scripts/auto-deploy.sh + a systemd timer (2min interval) that fetches
origin/master and, if ahead, pulls/rebuilds/migrates/restarts - same
sequence as the manual update steps in DEPLOYMENT.md, just scheduled.
Polling instead of a Gitea webhook deliberately: no extra exposed
service, no Docker socket mounted into a container, no shared secret
to manage - it's the same trust boundary as a manual SSH deploy.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

scripts/auto-deploy.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Polls the public CIAgent repo for new commits on master and redeploys if
+# found. Runs as a systemd timer on the server (infrastructure/systemd/) -
+# not a webhook, deliberately: a webhook receiver would need either the
+# Docker socket mounted into a container reachable from a request handler,
+# or a new exposed service/nginx route/shared secret to manage. Polling
+# does the same job with none of that - it's just this same sequence run on
+# a timer, on the host, as root, exactly like a manual deploy.
+#
+# The repo is public, so `git fetch` here needs no credentials.
+
+set -euo pipefail
+cd /opt/ci-agent
+
+git fetch origin master -q
+
+LOCAL=$(git rev-parse HEAD)
+REMOTE=$(git rev-parse origin/master)
+
+if [ "$LOCAL" = "$REMOTE" ]; then
+  exit 0
+fi
+
+echo "$(date -Iseconds) deploying $REMOTE (was $LOCAL)"
+
+git merge --ff-only origin/master
+docker compose -f docker-compose.prod.yml build api worker beat web
+docker compose -f docker-compose.prod.yml run --rm api alembic upgrade head
+docker compose -f docker-compose.prod.yml up -d
+
+echo "$(date -Iseconds) deploy complete: $REMOTE"