Gitea webhook receiver for mesh-internal event sync

[jordanpartridge]

Problem

No event-driven sync between machines. Everything is poll-based.

Solution

Tiny HTTP listener on each machine (bound to Tailscale IP only) that accepts Gitea push webhooks and triggers:

1. know sync (KB update)
2. git pull on plugin cache (hook/config updates)

Acceptance Criteria

• Listener script runs as systemd service on Tailscale IP only
• Gitea webhook configured to POST to all machines on push
• Sync completes within 30 seconds of push
• Zero public attack surface

Part of v1.1.0 release.