chore: scrub instance details and personal data from committed artefacts

Blood-pressure fixtures in the in-target integration suite were copied
from live readings; they are now synthetic with the same in/out split so
every assertion holds. Hard-coded operator hostnames move behind env vars
(DEPLOY_LOGS_URL, HEALTHLOG_PROD_URL), the codex client identifies via
the public repository URL, the OpenAPI servers entry points at a neutral
example host, and remaining workflow, docs and comment references to the
operator's instance or working notes are generalised. The compose
whitelist also gains DEPLOY_WEBHOOK_SECRET, which was missing and made
the deploy webhook unusable on compose installs.

src/__tests__/proxy-csp-hsts-hardening.test.ts

@@ -6,7 +6,7 @@ import { NextRequest } from "next/server";
  * needed to harden against first-visit MITM and to scope the
  * Withings backend host to its surface only.
  *
- *   - HSTS now carries `; preload` so `healthlog.bombeck.io` is
+ *   - HSTS now carries `; preload` so the served host is
  *     eligible for the Chromium HSTS preload list.
  *   - The `wbsapi.withings.net` `connect-src` entry only ships on
  *     the Withings surfaces (`/settings/integrations/withings/*`