Add git-pull-exec entrypoint

entrypoints/git-pull-exec.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+# Entrypoint: pull latest code from Gitea before exec.
+# Env vars:
+#   GIT_BRANCH  (default: main)
+#   GIT_SSH_KEY (default: /secrets/gitea_deploy_key)
+#
+# YAML/config changes in the repo are live on next container start
+# or ofelia exec — no rebuild needed.
+
+set -e
+
+BRANCH="${GIT_BRANCH:-main}"
+SSH_KEY="${GIT_SSH_KEY:-/secrets/gitea_deploy_key}"
+
+if [ -f "$SSH_KEY" ]; then
+  export GIT_SSH_COMMAND="ssh -i $SSH_KEY -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/tmp/.known_hosts"
+fi
+
+if [ -d "/app/.git" ]; then
+  echo "[entrypoint] Pulling latest ($BRANCH)..."
+  git -C /app fetch origin
+  git -C /app reset --hard "origin/$BRANCH"
+  echo "[entrypoint] Done."
+fi
+
+exec "$@"