Add webhook-triggered rebuilds for Pelican sites

Adds a webhook-deploy service that listens for Codeberg push events and
triggers per-site nixos-rebuild runs. Skips rebuilds if the flake lock
revision is unchanged. Fixes root SSH client config so nix flake update
can reach Codeberg using the existing deploy key.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

flake.nix

@@ -48,6 +48,7 @@
           ./modules/services/nostr-rs-relay.nix
           ./modules/services/podman.nix
           ./modules/services/static-sites
+          ./modules/services/webhook-deploy.nix
           ./modules/users/tobias.nix
         ];
       };