Switch deploy pipeline to Gitea polling; fix env-parsing and volume-isolation bugs

- Replace the bare-repo post-receive hook with deploy/poll-deploy.sh: Gitea
  and the Docker hosts are separate machines, so each box polls its branch
  via host crontab instead of needing an exposed webhook receiver.
- Add Blocksy theme + Blocksy Companion auto-install to deploy.sh (free
  tier; the paid Book Store starter site still needs a manual license step).
- Fix deploy.sh/backup.sh/restore.sh sourcing .env files as bash: a bcrypt
  hash's `$2a$14$...` shape breaks under `set -u`. Replaced with
  deploy/lib/env.sh, a literal (non-executing) KEY=VALUE reader.
- Fix docker compose itself mangling the same kind of value: both
  `environment: ${VAR}` and `env_file:` run values through Compose's
  interpolation, which silently blanks `$identifier`-shaped substrings.
  The staging basic-auth hash is now rendered directly into the Caddyfile
  by deploy.sh, bypassing Compose's variable system entirely.
- Fix dev/staging/production silently sharing one Compose project (and
  therefore one db_data volume) by pinning an explicit -p per environment.
- cron and wordpress now share one environment anchor so they can't drift
  apart again (cron was silently missing WORDPRESS_CONFIG_EXTRA before).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/lib/env.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Reads one KEY=VALUE out of a .env-style file WITHOUT ever executing the
+# file as shell. `source`-ing a .env file breaks the moment a value contains
+# characters bash treats specially — e.g. a Caddy bcrypt hash
+# ($2a$14$...) looks like positional-parameter expansions ($2, $14, ...) to
+# bash and blows up under `set -u`. docker compose's own --env-file parser
+# already treats these files as literal key=value data; this matches that.
+env_get() {
+  local file="$1" key="$2" line val
+  line="$(grep -m1 -E "^${key}=" "$file" 2>/dev/null || true)"
+  val="${line#*=}"
+  if [[ "$val" == \"*\" && "$val" == *\" ]]; then
+    val="${val#\"}"; val="${val%\"}"
+  elif [[ "$val" == \'*\' && "$val" == *\' ]]; then
+    val="${val#\'}"; val="${val%\'}"
+  fi
+  printf '%s' "$val"
+}