fix(deploy): use live Coolify webhook route

[Codevena]

Problem and outcome

The checked-in deployment controller allowed the wrong manual Coolify webhook path. The running Coolify 4.0.0-beta.470 instance mounts the handler at /webhooks/source/github/events/manual; the previous /source/github/events/manual target returns HTTP 419. This change updates the exact fail-closed allowlist and the cutover documentation.

Compatibility, security, and migrations

No A2A, MCP, API, database, or migration changes. The controller still accepts only one exact AgoraHub webhook target. The generic Coolify deploy API remains blocked at Cloudflare Access. COOLIFY_CD_ENABLED remains false during this PR.

Verification

• Regression test added and observed failing before the production fix
• Lint, typecheck, full tests, and production build pass
• Cutover plan and design spec updated
• No credentials, personal data, local paths, or agent-only instructions added

Commands and results:

pnpm lint       -> pass
pnpm typecheck  -> pass
pnpm test       -> 502/502 pass
pnpm build      -> pass, 48/48 pages
git diff --check -> pass
Codex review    -> PASS
Gemini review   -> PASS