chore: add synology auto-deploy setup

deploy.php

@@ -0,0 +1,55 @@
+<?php
+$method = $_SERVER['REQUEST_METHOD'] ?? '';
+if ($method !== 'POST') {
+    http_response_code(405);
+    echo 'Method Not Allowed';
+    exit;
+}
+
+$payload = file_get_contents('php://input');
+if ($payload === false || $payload === '') {
+    http_response_code(400);
+    echo 'Empty payload';
+    exit;
+}
+
+$event = $_SERVER['HTTP_X_GITEA_EVENT'] ?? '';
+$secret = getenv('GITEA_WEBHOOK_SECRET');
+$signature = $_SERVER['HTTP_X_GITEA_SIGNATURE'] ?? '';
+
+if ($secret !== false && $secret !== '') {
+    if ($signature === '') {
+        http_response_code(401);
+        echo 'Missing signature';
+        exit;
+    }
+    $hash = hash_hmac('sha256', $payload, $secret, false);
+    if (!hash_equals($hash, $signature)) {
+        http_response_code(401);
+        echo 'Invalid signature';
+        exit;
+    }
+}
+
+$decoded = json_decode($payload, true);
+if (json_last_error() !== JSON_ERROR_NONE) {
+    http_response_code(400);
+    echo 'Invalid JSON';
+    exit;
+}
+
+if ($event !== 'push') {
+    http_response_code(202);
+    echo 'Ignored';
+    exit;
+}
+
+$ref = $decoded['ref'] ?? '';
+if ($ref !== 'refs/heads/main') {
+    http_response_code(202);
+    echo 'Ignored';
+    exit;
+}
+
+exec('/bin/sudo -u admin_hz2 /bin/bash /volume2/webssd/fabiennefoehn/deploy-staging.sh > /dev/null 2>&1 &');
+echo 'Deploy triggered';