Automate production deploys of main (Maestro 85cca5ad)

deploy/auto-deploy.sh runs deploy/RUNBOOK.md unattended: no-op when
origin/main is the last deployed SHA in the deploy record, wait while its
Gitea CI status is pending, refuse (exit 1) on failure or no status, then
run every runbook block (rollback SHA from the running /health, clean
checkout, make docker, Litestream restore point, boot-required
configuration, retag, restart, version and PWA verification) and append a
deploy record line. --ref <ref> deploys an explicit ref through the same
blocks, bypassing the gates. A failed deploy is recorded and never retried
by the timer.

mealquest-auto-deploy.service/.timer run it as overseer every 15 minutes
(+5 min random delay), skipped while mealquest.service is not active.

deploy/RUNBOOK.md is the PR #203 runbook (feature/launch-readiness, not yet
on dev) plus an "Automated deploys" section; AGENTS.md describes deploy/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/systemd/mealquest-auto-deploy.timer

@@ -0,0 +1,17 @@
+# Checks for a new main every 15 minutes (plus up to 5 minutes' random
+# delay), starting 2 minutes after the timer starts. OnUnitActiveSec= alone
+# never fires before the service's first run, so OnActiveSec= starts the
+# cycle at boot and at `enable --now`. Persistent= is set as the task
+# specified; systemd applies it only to OnCalendar= triggers, so with these
+# monotonic triggers it has no effect.
+[Unit]
+Description=Periodic MealQuest automated deploy
+
+[Timer]
+OnActiveSec=2min
+OnUnitActiveSec=15min
+RandomizedDelaySec=5min
+Persistent=true
+
+[Install]
+WantedBy=timers.target