pilot: central webhook service (user-level Gitea webhook + AI-REVIEW gate)

- pilot/webhook_server.py: stdlib HTTP receiver. HMAC-verifies X-Gitea-Signature,
  gates on pull_request action + AI-REVIEW label, runs review_pr in a background
  thread (responds 202 immediately so Gitea's delivery timeout never fires).
  Accepts both GitHub-style (labeled/synchronize) and Gitea event-type-style
  (label_updated/synchronized) action names.
- pilot/ai_review.py: extract review_pr() core so both the CI run() and the
  webhook server share one review path. run() is now an env-driven wrapper.
- pilot/README-webhook.md: architecture, onboarding, one-time per-owner
  user-webhook setup, the Gitea 1.26.1 system-webhook bug, the SSRF
  ALLOWED_HOST_LIST change, K8s deploy + script-update recipe.
- README.md + design doc: note the webhook service as the preferred delivery
  path (partially reverses 'central webhook = non-goal', pilot only).

Gitea 1.26.1 system webhooks broken (POST /admin/hooks -> 201 but never
persists); user-level webhooks (one per repo-owner) are the working fallback.
Gitea SSRF allow-list blocks in-cluster webhook targets by default; required a
scoped [webhook] ALLOWED_HOST_LIST addition + gitea restart.

E2E verified 2026-08-17: pragent-bot reviewed gitea_admin/pragent PR #2 and
masi/portfolio PR #3 via the webhook service (glm-5.2:cloud).

Co-Authored-By: Claude <noreply@anthropic.com>

README.md

@@ -3,10 +3,19 @@
 An extensible, forge-agnostic PR review framework. Not a product — a toolkit that teams
 extend with their own review dimensions.
 
-**Status:** design approved; framework build deferred. A **pilot** is live — a
-minimal AI review bot running as a Gitea Actions step on `glm-5.2:cloud`. See
-[`pilot/README.md`](pilot/README.md) to onboard a repo. The framework design
-remains at [`docs/plans/2026-08-04-pragent-design.md`](docs/plans/2026-08-04-pragent-design.md);
+**Status:** design approved; framework build deferred. A **pilot** is live on
+`glm-5.2:cloud` with two delivery paths:
+
+- **Central webhook service** (preferred, least per-repo setup): a Gitea
+  user-level webhook posts PR events to an always-on in-cluster service that
+  gates on the `AI-REVIEW` label. Onboarding a repo = add `pragent-bot`
+  collaborator + create the label + label a PR. See
+  [`pilot/README-webhook.md`](pilot/README-webhook.md).
+- **CI-step** (legacy): a per-repo Gitea Action fetches the reviewer script at
+  runtime. See [`pilot/README.md`](pilot/README.md).
+
+The framework design remains at
+[`docs/plans/2026-08-04-pragent-design.md`](docs/plans/2026-08-04-pragent-design.md);
 the pilot is its bootstrap and will be superseded by `pragent review` when the
 framework build resumes.