chore: scrub instance details and personal data from committed artefacts

Blood-pressure fixtures in the in-target integration suite were copied
from live readings; they are now synthetic with the same in/out split so
every assertion holds. Hard-coded operator hostnames move behind env vars
(DEPLOY_LOGS_URL, HEALTHLOG_PROD_URL), the codex client identifies via
the public repository URL, the OpenAPI servers entry points at a neutral
example host, and remaining workflow, docs and comment references to the
operator's instance or working notes are generalised. The compose
whitelist also gains DEPLOY_WEBHOOK_SECRET, which was missing and made
the deploy webhook unusable on compose installs.

src/components/admin/__tests__/admin-shell.test.tsx

@@ -58,8 +58,8 @@ describe("<AdminShell>", () => {
     // The 13-section strip is ~1700 CSS px wide. Without
     // `no-scrollbar` (defined in `globals.css`) Chromium/WebKit paint
     // an always-on horizontal scrollbar at the top of every admin
-    // page. Production probe at https://healthlog.bombeck.io/admin/
-    // api-tokens at Pixel-5 viewport pins this as the *only* element
+    // page. A live probe of /admin/api-tokens at a Pixel-5 viewport
+    // pins this as the *only* element
     // with `overflow-x:auto AND scrollWidth > clientWidth`, so the
     // class is the load-bearing fix.
     const html = renderShell({ active: "api-tokens" });