M3: bridge deployed + verified publicly reachable; webhook delivery blocked at Gitea (ALLOWED_HOST_LIST)

Bridge healthz 200 over public DNS; HMAC verified. Gitea sends no deliveries
(suspect webhook host allowlist). Recorded in STATUS Blocked + operator options.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bridge/bridge.py

@@ -116,7 +116,9 @@ class Handler(BaseHTTPRequestHandler):
         sig = self.headers.get("X-Gitea-Signature", "")
         expected = hmac.new(HMAC_SECRET, body, hashlib.sha256).hexdigest()
         if not hmac.compare_digest(sig, expected):
-            log("rejected: bad signature")
+            log(f"rejected: bad signature event={self.headers.get('X-Gitea-Event')} "
+                f"got={sig[:12]} want={expected[:12]} bodylen={len(body)} seclen={len(HMAC_SECRET)} "
+                f"hub256={(self.headers.get('X-Hub-Signature-256') or '')[:20]}")
             return self._send(401, "bad signature")
 
         if self.headers.get("X-Gitea-Event") != "issue_comment":