feat: add repository-level webhook

[cohesive-flight]

Proposed change

Adds a repository-level webhook that deploys all git stacks belonging to the same repository across all environments. Includes smart filtering (only deploy stacks whose files changed) and shared repo cloning.

Closes #154

Type of change

• Bug fix: non-breaking change which fixes an issue.
• New feature / Enhancement: non-breaking change which adds functionality.
• Breaking change: fix or feature that would cause existing functionality to not work as expected.
• Other. Please explain:

[CLAassistant]

All committers have signed the CLA.

[cohesive-flight]

@jotka requesting review.

[jotka]

thanks for this, genuinley useful feature and the smart-filter idea is nice. few things i want sorted before it goes in though:

1. concurrency. the webhook fires the deploy in the background and returns 202 straight away, but syncSharedRepository does fetch + git reset --hard on one shared repo dir. two pushes close together (merge that pushes a tag + branch, whatever) = two resets racing on the same working tree while stacks are reading compose files out of it. needs a per-repo lock/queue so runs cant overlap.

2. no branch check. old handler had the branch guard (commented out), new one dropped it entirely - so a push to any branch triggers a redeploy of the tracked branch. should compare payload ref against repository.branch and just 200/ignore if it doesnt match.

3. gitlab token compare is signature === secret, plain string equality = timing sidechannel. the github sha256 path already does timingSafeEqual, do the same for gitlab.

4. security-wise this is a bigger blast radius than before (single stack -> every stack in every env), and the UI still lets you enable the webhook with an empty secret. combined thats an unauthed all-env deploy for anyone who knows the repo id. can we require a secret when webhook is enabled? also the GET trigger takes the secret in the query string which ends up in logs/referer - id rather drop the GET deploy path or move it behind auth.

couple smaller ones: deployOne basically reimplements the existing per-stack deploy logic (incl the new commitHash skip you added), would be nice to share that. and lastCommit is stored as a 7-char short sha which is a bit fragile for the equality checks - fine to keep full sha and just shorten for display.

rest looks good. migrations for both sqlite/pg are there which is great. happy to help if any of these are fiddly.

[cohesive-flight]

@jotka done.

[MichiFr]

Oh, just found this code enhancement. Guess, we can expect this in any of the upcoming releases very soon?