deploy: Docker compose + entrypoint (pull-loop autosync), Nix revert script, .env (gitignored) for Gitea deploy token

deploy/kontra-pull.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+# Kontra content deploy: pull from Gitea; restart site if content changed.
+# Runs as ROOT (systemd oneshot). Git runs as 'sam' (uses sam's Gitea SSH key)
+# via runuser (NixOS-native drop-privilege); restart needs root.
+set -e
+CONTENT=/var/www/kontra_day/content
+GIT=/run/current-system/sw/bin/git
+RUNUSER=/run/current-system/sw/bin/runuser
+
+BEFORE=$("$RUNUSER" -u sam -- "$GIT" -C "$CONTENT" rev-parse HEAD)
+"$RUNUSER" -u sam -- "$GIT" -C "$CONTENT" pull --ff-only origin main >/tmp/kontra-pull.log 2>&1 \
+  || { echo "pull failed:"; cat /tmp/kontra-pull.log; exit 1; }
+AFTER=$("$RUNUSER" -u sam -- "$GIT" -C "$CONTENT" rev-parse HEAD)
+
+if [ -n "$BEFORE" ] && [ -n "$AFTER" ] && [ "$BEFORE" != "$AFTER" ]; then
+  echo "content changed: $BEFORE -> $AFTER; restarting kontra"
+  "/run/current-system/sw/bin/systemctl" restart kontra.service
+fi
+exit 0