CI/CD: webhook receiver + deploy automatico su push

- deploy.sh: git pull, pip install, migrate, collectstatic, restart gunicorn
- webhook_receiver.py: HTTP server con verifica HMAC-SHA256 Gitea
- olimpic-nastri-webhook.service: systemd unit per il receiver
- Nginx: aggiunto proxy /webhook/deploy → porta 9000
- sudoers: restart gunicorn senza password per deploy automatico

olimpic-nastri-webhook.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Webhook receiver per deploy automatico Diario Olimpic Nastri
+After=network.target
+
+[Service]
+User=marco
+Group=www-data
+WorkingDirectory=/home/marco/olimpic_nastri
+ExecStart=/usr/bin/python3 /home/marco/olimpic_nastri/webhook_receiver.py
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target