feat(mcpedia): Phase 4 — operability + correctness hardening

Reinterpreted from the plan's YAGNI 'Scale-out' (OpenSearch/object-storage
/multi-tenant deferred at KB scale). Phase 4 = make the Phase 3 async +
revision system correct, secure, observable, deployable.

- T1 (correctness bug): restoreRevision now rebuilds semantic chunks via new
  @mcpedia/core reindexChunks(slug) so semantic/hybrid search stay consistent
  after a restore (previously document_chunks held the NEW body while
  documents.body held the restored OLD body -> stale search).
- T2 (security): /hooks/* git-sync webhooks now require x-webhook-secret header
  matching WEBHOOK_SECRET (401 otherwise); API fails fast at startup if unset.
  Added WEBHOOK_SECRET to @mcpedia/config + .env.example; set real secret in .env.
- T3 (UX): web doc page shows a History panel (revision no/reason/date/length)
  with per-revision Restore; app/api/revisions/restore/route.ts calls
  restoreRevision + revalidatePath (server-component only, no client JS).
- T4: listRevisions gains offset paging; summary never includes body.
- T5 (ops): deploy/mcpedia-api.service + deploy/mcpedia-worker.service systemd
  units (Restart=on-failure, EnvironmentFile=.env). Not auto-enabled on host.

Verified against live imrnes Redis + Postgres: turbo typecheck+build green;
restore-rebuilds-chunks (marker present -> gone after restore); webhook 401/200;
web restore route redirects to doc + reverts body; revisions API returns summary
(no body); systemd-analyze verify passes.

README.md

@@ -140,9 +140,30 @@ Git-sync webhooks (enqueue BullMQ jobs; the worker processes them):
   push webhook here to auto-reindex on push).
 - `POST /hooks/index?slug=<slug>` — reindex a single document.
 
+> **Security:** both webhooks require an `x-webhook-secret` header that matches
+> `WEBHOOK_SECRET` (set in `.env`). The API refuses to start if `WEBHOOK_SECRET`
+> is unset, so the hooks are never left open.
+
 `bun run index` now also chunks + embeds (Phase 2 indexer) and snapshots a
 revision whenever the body changes (Phase 3). See `.env.example` for
-`EMBED_*` / `REDIS_*` / `QUEUE_PREFIX` vars.
+`EMBED_*` / `REDIS_*` / `QUEUE_PREFIX` / `WEBHOOK_SECRET` vars.
+
+### Run as a supervised service (Phase 4)
+
+`deploy/mcpedia-api.service` + `deploy/mcpedia-worker.service` are systemd units
+(`Restart=on-failure`, `EnvironmentFile=.env`, `WorkingDirectory=/home/code/mcpedia`).
+Enable them with:
+
+```bash
+sudo cp deploy/*.service /etc/systemd/system/
+sudo systemctl daemon-reload
+sudo systemctl enable --now mcpedia-api mcpedia-worker
+# tail logs
+journalctl -u mcpedia-api -u mcpedia-worker -f
+```
+
+The API should sit behind Caddy (or your reverse proxy) for TLS; expose only
+`:4020` internally and the web app publicly.
 
 ## Status