fix(deploy): wire Phase 3 services + GitHub git-sync webhook

- apps/api: assertWebhookAuth now verifies GitHub X-Hub-Signature-256 HMAC
  (raw-body HMAC-SHA256) AND the manual x-webhook-secret header. GitHub does
  not send a custom header, so only the HMAC path made the push webhook work.
- root package.json: api/worker scripts use absolute bun path + direct-file
  form (bun --cwd apps/api run dev errored in bun 1.3.14).
- deploy/*.service: ExecStart uses /home/code/.bun/bin/bun (systemd PATH lacks bun).
- GitHub push webhook created -> https://wiki.asepharyana.my.id/hooks/reindex
  (verified: ping + push deliveries return 200, worker drains, 0 failed).
- Caddy: expose /hooks/* + /health on wiki.asepharyana.my.id -> :4020.
Services mcpedia-api + mcpedia-worker now enabled + active on host.

package.json

@@ -15,9 +15,9 @@
     "typecheck": "turbo run typecheck",
     "index": "bun run scripts/indexer.ts",
     "enqueue": "bun run scripts/enqueue.ts",
-    "worker": "bun --cwd apps/worker run start",
+    "worker": "/home/code/.bun/bin/bun --cwd apps/worker src/index.ts",
     "mcp": "bun --cwd apps/mcp run start",
-    "api": "bun --cwd apps/api run dev"
+    "api": "/home/code/.bun/bin/bun --cwd apps/api src/index.ts"
   },
   "devDependencies": {
     "@trpc/client": "^11.18.0",