docs(deploy): describe the deploy webhook's signature and strict mode

The compose comment still called DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP a
requirement for a fresh timestamp header, which the route stopped
accepting in strict mode once requests could be signed, and the env
manifest named only the secret header and lacked the strict switch. Both
now say what the route checks: the secret header, which has no replay
protection, or X-Deploy-Webhook-Signature over the timestamp and body,
and that the strict setting takes signed requests only. The development
example says the same and points at the deploy runbook instead of a page
that no longer exists.

.env.example

@@ -361,11 +361,17 @@ API_TOKEN_HMAC_KEY="REPLACE-WITH-OUTPUT-OF-openssl-rand-hex-32"
 # Auto-deploy webhook (v1.4.15 — phase C2)
 # -----------------------------------------------------------------------------
 # Coolify (or any CI) pings POST /api/internal/deploy-webhook after a deploy
-# attempt with success/failure. We verify the request via this shared secret
-# carried in the `X-Deploy-Webhook-Secret` header (timing-safe compare).
-# Generate with `openssl rand -hex 32`. Configure the SAME value in Coolify's
-# Notifications → Webhook custom-headers panel. See docs/audit/v1415-auto-deploy.md.
+# attempt with success/failure. A request authenticates with this shared
+# secret in the `X-Deploy-Webhook-Secret` header (timing-safe compare; what
+# Coolify's stock sender does, with no replay protection), or by signing:
+# `X-Deploy-Webhook-Signature: sha256=<hex>`, the HMAC-SHA256 under this
+# secret of the `X-Deploy-Webhook-Timestamp` value, a dot and the raw body,
+# the timestamp within 5 minutes. Generate with `openssl rand -hex 32`.
+# Configure the SAME value in Coolify's Notifications → Webhook
+# custom-headers panel. See docs/ops/deploy.md.
 # DEPLOY_WEBHOOK_SECRET=""
+# "true" accepts signed requests only; leave unset for Coolify's stock sender.
+# DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP=""
 
 
 # -----------------------------------------------------------------------------