M3: bridge deployed + verified publicly reachable; webhook delivery blocked at Gitea (ALLOWED_HOST_LIST)

Bridge healthz 200 over public DNS; HMAC verified. Gitea sends no deliveries
(suspect webhook host allowlist). Recorded in STATUS Blocked + operator options.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

hosts/cc-ci/configuration.nix

@@ -12,6 +12,7 @@
     ../../modules/proxy.nix
     ../../modules/drone.nix
     ../../modules/drone-runner.nix
+    ../../modules/bridge.nix
   ];
 
   # --- Tailscale (ACCESS-CRITICAL: do not break, this is the only route in) ---