feat: no-root deploy, remove CI deploy stage, deploy alerts

- deploy.sh installs sops/age to ./bin/ (no root/sudo needed)
- Remove CI deploy stage — supervisor auto-pulls and deploys
  (zero CI secrets: no SSH keys, no deploy credentials)
- Supervisor sends alert on deploy success/failure via webhook

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/padelnomics/supervisor.py

@@ -321,7 +321,11 @@ def tick() -> None:
         # Deploy web app if code changed
         if os.getenv("SUPERVISOR_GIT_PULL") and web_code_changed():
             logger.info("Web code changed — deploying")
-            run_shell("./deploy.sh")
+            ok, _ = run_shell("./deploy.sh")
+            if ok:
+                send_alert("Deploy succeeded")
+            else:
+                send_alert("Deploy FAILED — check journalctl -u padelnomics-supervisor")
     finally:
         conn.close()