Full Gitea Actions CI/CD with cPanel git deployment

- CI workflow: PHP lint, security scan, schema validation
- Deploy workflow: SSH -> cPanel git push + WP REST API fallback + verify
- Sync workflow: cPanel sync + Nextcloud artifact upload
- Health workflow: every 30min plugin health check
- Scripts: verify-deploy, deploy-report, check-namespace, health-check, setup-secrets
- README with full architecture documentation
- Gitea Actions runner registered on Docker Swarm (contabo-swarm-runner)

.gitea/scripts/health-check.py

@@ -0,0 +1,42 @@
+#!/usr/bin/env python3
+"""Health check for Hermes cPanel Agent via WP REST API.
+Usage: cat plugins.json | python3 health-check.py
+"""
+import json, sys
+
+def check():
+    try:
+        data = json.load(sys.stdin)
+    except json.JSONDecodeError:
+        print("FAIL: Cannot parse WP API response")
+        return False
+
+    if isinstance(data, dict) and "code" in data:
+        print(f"FAIL: WP API error - {data.get('message', 'unknown')}")
+        return False
+
+    if not isinstance(data, list):
+        print(f"WARN: Unexpected response format")
+        return True
+
+    found = False
+    for p in data:
+        if isinstance(p, dict) and p.get("textdomain") == "hermes-ai-bridge":
+            status = p.get("status", "unknown")
+            ver = p.get("version", "?")
+            name = p.get("name", "?")
+            found = True
+            if status == "active":
+                print(f"HEALTHY: {name} v{ver} status={status}")
+                return True
+            else:
+                print(f"DEGRADED: {name} v{ver} status={status}")
+                return False
+
+    if not found:
+        print("FAIL: hermes-cpanel-agent plugin not found on WordPress")
+        return False
+
+if __name__ == "__main__":
+    ok = check()
+    sys.exit(0 if ok else 1)