Switch deploy pipeline to Gitea polling; fix env-parsing and volume-isolation bugs

- Replace the bare-repo post-receive hook with deploy/poll-deploy.sh: Gitea
  and the Docker hosts are separate machines, so each box polls its branch
  via host crontab instead of needing an exposed webhook receiver.
- Add Blocksy theme + Blocksy Companion auto-install to deploy.sh (free
  tier; the paid Book Store starter site still needs a manual license step).
- Fix deploy.sh/backup.sh/restore.sh sourcing .env files as bash: a bcrypt
  hash's `$2a$14$...` shape breaks under `set -u`. Replaced with
  deploy/lib/env.sh, a literal (non-executing) KEY=VALUE reader.
- Fix docker compose itself mangling the same kind of value: both
  `environment: ${VAR}` and `env_file:` run values through Compose's
  interpolation, which silently blanks `$identifier`-shaped substrings.
  The staging basic-auth hash is now rendered directly into the Caddyfile
  by deploy.sh, bypassing Compose's variable system entirely.
- Fix dev/staging/production silently sharing one Compose project (and
  therefore one db_data volume) by pinning an explicit -p per environment.
- cron and wordpress now share one environment anchor so they can't drift
  apart again (cron was silently missing WORDPRESS_CONFIG_EXTRA before).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker/caddy/Caddyfile.staging

@@ -3,8 +3,16 @@
 
 	# Launch gate: "No staging URLs are publicly indexed." Belt-and-suspenders
 	# with wp_option blog_public=0, which deploy.sh sets on staging.
+	#
+	# The two tokens below are substituted by deploy.sh directly (bash string
+	# replacement), not by Caddy's {$VAR} or docker compose's ${VAR} — a
+	# bcrypt hash contains `$identifier`-looking substrings that Compose's
+	# own interpolation will silently corrupt if this value ever passes
+	# through it (confirmed: both `environment:` and `env_file:` are
+	# affected). This file is a tracked template; deploy.sh renders it into
+	# docker/caddy/.generated/Caddyfile.staging, which is what's mounted.
 	basic_auth {
-		{$STAGING_BASIC_AUTH_USER} {$STAGING_BASIC_AUTH_HASH}
+		__STAGING_BASIC_AUTH_USER__ __STAGING_BASIC_AUTH_HASH__
 	}
 	header X-Robots-Tag "noindex, nofollow, noarchive"