M3: bridge deployed + verified publicly reachable; webhook delivery blocked at Gitea (ALLOWED_HOST_LIST)

Bridge healthz 200 over public DNS; HMAC verified. Gitea sends no deliveries
(suspect webhook host allowlist). Recorded in STATUS Blocked + operator options.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

modules/secrets.nix

@@ -21,6 +21,12 @@
     secrets.drone_rpc_secret = { };
     secrets.drone_gitea_client_secret = { };
 
+    # M3 comment-bridge (A2). Read by modules/bridge.nix's reconcile oneshot, which copies them
+    # into swarm secrets the bridge container mounts. webhook_hmac is also set on the Gitea webhook.
+    secrets.bridge_webhook_hmac = { };
+    secrets.bridge_drone_token = { };
+    secrets.bridge_gitea_token = { };
+
     # EnvironmentFile for the host exec runner: DRONE_RPC_SECRET rendered from the sops secret.
     templates."drone-runner.env".content = ''
       DRONE_RPC_SECRET=${config.sops.placeholder.drone_rpc_secret}