fix(deploy-webhook): keep DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP's meaning, add a signature-only flag

DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP had been changed to mean signed requests
only, so an operator who set it for a sender that adds a timestamp but cannot
sign would have had every deploy notification refused after the upgrade. It
means the secret header plus a fresh timestamp again. Signature-only, the
setting that stops a replay, is DEPLOY_WEBHOOK_REQUIRE_SIGNATURE, on the
compose whitelist, in the env manifest and examples, and in the deploy
guide.

.env.example

@@ -376,8 +376,12 @@ API_TOKEN_HMAC_KEY="REPLACE-WITH-OUTPUT-OF-openssl-rand-hex-32"
 # Configure the SAME value in Coolify's Notifications → Webhook
 # custom-headers panel. See docs/ops/deploy.md.
 # DEPLOY_WEBHOOK_SECRET=""
-# "true" accepts signed requests only; leave unset for Coolify's stock sender.
+# "true" also requires a fresh X-Deploy-Webhook-Timestamp on a secret-header
+# request; leave unset for Coolify's stock sender, which sends none.
 # DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP=""
+# "true" accepts signed requests only (the setting that stops a replay);
+# leave unset for Coolify's stock sender.
+# DEPLOY_WEBHOOK_REQUIRE_SIGNATURE=""
 
 
 # -----------------------------------------------------------------------------