Switch deploy pipeline to Gitea polling; fix env-parsing and volume-isolation bugs

- Replace the bare-repo post-receive hook with deploy/poll-deploy.sh: Gitea
  and the Docker hosts are separate machines, so each box polls its branch
  via host crontab instead of needing an exposed webhook receiver.
- Add Blocksy theme + Blocksy Companion auto-install to deploy.sh (free
  tier; the paid Book Store starter site still needs a manual license step).
- Fix deploy.sh/backup.sh/restore.sh sourcing .env files as bash: a bcrypt
  hash's `$2a$14$...` shape breaks under `set -u`. Replaced with
  deploy/lib/env.sh, a literal (non-executing) KEY=VALUE reader.
- Fix docker compose itself mangling the same kind of value: both
  `environment: ${VAR}` and `env_file:` run values through Compose's
  interpolation, which silently blanks `$identifier`-shaped substrings.
  The staging basic-auth hash is now rendered directly into the Caddyfile
  by deploy.sh, bypassing Compose's variable system entirely.
- Fix dev/staging/production silently sharing one Compose project (and
  therefore one db_data volume) by pinning an explicit -p per environment.
- cron and wordpress now share one environment anchor so they can't drift
  apart again (cron was silently missing WORDPRESS_CONFIG_EXTRA before).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.staging.yml

@@ -16,12 +16,14 @@ services:
     ports:
       - "80:80"
       - "443:443"
-    environment:
-      SITE_DOMAIN: ${SITE_DOMAIN}
-      STAGING_BASIC_AUTH_USER: ${STAGING_BASIC_AUTH_USER}
-      STAGING_BASIC_AUTH_HASH: ${STAGING_BASIC_AUTH_HASH}
+    # SITE_DOMAIN is safe to pass through normally (no `$` in a domain name).
+    # STAGING_BASIC_AUTH_USER/HASH are NOT passed via compose at all — see
+    # the comment in docker/caddy/Caddyfile.staging for why; deploy.sh
+    # renders them directly into the mounted file below instead.
+    env_file:
+      - .env.staging
     volumes:
-      - ./docker/caddy/Caddyfile.staging:/etc/caddy/Caddyfile:ro
+      - ./docker/caddy/.generated/Caddyfile.staging:/etc/caddy/Caddyfile:ro
       - wp_core:/var/www/html:ro
       - wp_uploads:/var/www/html/wp-content/uploads:ro
       - wp_themes:/var/www/html/wp-content/themes:ro