Initial commit with server startup infrastructure

Core infrastructure:
- Uber fx dependency injection
- Chi router with middleware stack
- SQLite database with embedded migrations
- Embedded templates and static assets
- Structured logging with slog

Features implemented:
- Authentication (login, logout, session management, argon2id hashing)
- App management (create, edit, delete, list)
- Deployment pipeline (clone, build, deploy, health check)
- Webhook processing for Gitea
- Notifications (ntfy, Slack)
- Environment variables, labels, volumes per app
- SSH key generation for deploy keys

Server startup:
- Server.Run() starts HTTP server on configured port
- Server.Shutdown() for graceful shutdown
- SetupRoutes() wires all handlers with chi router

internal/handlers/webhook.go

@@ -0,0 +1,72 @@
+package handlers
+
+import (
+	"io"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+
+	"git.eeqj.de/sneak/upaas/internal/models"
+)
+
+// HandleWebhook handles incoming Gitea webhooks.
+func (h *Handlers) HandleWebhook() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		secret := chi.URLParam(request, "secret")
+		if secret == "" {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		// Find app by webhook secret
+		application, findErr := models.FindAppByWebhookSecret(
+			request.Context(),
+			h.db,
+			secret,
+		)
+		if findErr != nil {
+			h.log.Error("failed to find app by webhook secret", "error", findErr)
+			http.Error(writer, "Internal Server Error", http.StatusInternalServerError)
+
+			return
+		}
+
+		if application == nil {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		// Read request body
+		body, readErr := io.ReadAll(request.Body)
+		if readErr != nil {
+			h.log.Error("failed to read webhook body", "error", readErr)
+			http.Error(writer, "Bad Request", http.StatusBadRequest)
+
+			return
+		}
+
+		// Get event type from header
+		eventType := request.Header.Get("X-Gitea-Event")
+		if eventType == "" {
+			eventType = "push"
+		}
+
+		// Process webhook
+		webhookErr := h.webhook.HandleWebhook(
+			request.Context(),
+			application,
+			eventType,
+			body,
+		)
+		if webhookErr != nil {
+			h.log.Error("failed to process webhook", "error", webhookErr)
+			http.Error(writer, "Internal Server Error", http.StatusInternalServerError)
+
+			return
+		}
+
+		writer.WriteHeader(http.StatusOK)
+	}
+}