feat: add deploy webhook endpoint (POST /api/v1/_deploy)

internal/config/config.go

@@ -23,6 +23,7 @@ type Config struct {
 	LLMEndpoint     string
 	GoogleClientID  string
 	JWTSecret       string
+	DeploySecret    string
 }
 
 func LoadFromEnv() Config {
@@ -38,6 +39,7 @@ func LoadFromEnv() Config {
 		LLMEndpoint:     envOrDefault("TUTOR_LLM_ENDPOINT", ""),
 		GoogleClientID:  envOrDefault("GOOGLE_CLIENT_ID", ""),
 		JWTSecret:       envOrDefault("JWT_SECRET", ""),
+		DeploySecret:    envOrDefault("TUTOR_DEPLOY_SECRET", ""),
 	}
 }
 
@@ -45,6 +47,10 @@ func (c Config) HasLLM() bool {
 	return c.LLMEndpoint != ""
 }
 
+func (c Config) HasDeploy() bool {
+	return c.DeploySecret != ""
+}
+
 func envOrDefault(key string, fallback string) string {
 	value := os.Getenv(key)
 	if value == "" {

internal/httpapi/deploy.go

@@ -0,0 +1,31 @@
+package httpapi
+
+import (
+	"log"
+	"net/http"
+	"os/exec"
+)
+
+func (h Handler) handleDeploy(w http.ResponseWriter, r *http.Request) {
+	if !h.cfg.HasDeploy() {
+		writeError(w, http.StatusNotFound, "deploy endpoint not configured")
+		return
+	}
+
+	if r.Header.Get("X-Deploy-Secret") != h.cfg.DeploySecret {
+		writeError(w, http.StatusUnauthorized, "invalid deploy secret")
+		return
+	}
+
+	writeJSON(w, http.StatusAccepted, map[string]string{"status": "deploy started"})
+
+	go func() {
+		cmd := exec.Command("/bin/bash", "deploy.sh")
+		output, err := cmd.CombinedOutput()
+		if err != nil {
+			log.Printf("[deploy] failed: %v, output: %s", err, string(output))
+			return
+		}
+		log.Printf("[deploy] success: %s", string(output))
+	}()
+}

internal/httpapi/handler.go

@@ -53,6 +53,9 @@ func (h Handler) Routes() http.Handler {
 	mux.HandleFunc("GET /api/v1/ontology", h.getOntology)
 	mux.HandleFunc("POST /api/v1/teaching-assets/prompts", h.generateTeachingAssetPrompt)
 	mux.HandleFunc("GET /api/v1/teaching-assets", h.getTeachingAssets)
+	if h.cfg.HasDeploy() {
+		mux.HandleFunc("POST /api/v1/_deploy", h.handleDeploy)
+	}
 	mux.Handle("GET /", webapp.Handler())
 	return mux
 }