Document Gitea webhook verification details

AGENTS.md

@@ -48,6 +48,14 @@ what we take vs. skip). Never vendor it into the build.
   in project Personal, `https://tunnel.tzgyn.dev`, deploy-key source on the
   shared `gitea` key, push to `main` auto-deploys via the Gitea webhook.
   Redeploy with `POST /api/v1/deploy?uuid=<app>` (the GET form is gone).
+  Webhook details when debugging: Coolify's *manual* Gitea webhook verifies
+  `X-Hub-Signature-256` (HMAC-SHA256 hex of the raw body with the app's
+  `manual_webhook_secret_gitea`; Gitea sends this header natively) and
+  matches apps by `repository.full_name` against the app's `git_repository`
+  after canonicalization — the `:22222` port in the scp-style URL is ignored,
+  so it matches fine. A curl replay needs `X-Gitea-Event: push` and the
+  signature header, or it answers "No matching application or invalid
+  signature."
   This Coolify version stores `custom_labels` **base64-encoded** and does
   *not* merge its generated Traefik labels for API-created apps: the full
   label set must live in `custom_labels` (mirror a working app's generated