fix: step 6 webhooks demo - replace 404 events API with webhook registration flow

- Replace /events/v2/* endpoints (404 in sandbox) with /api/v1/webhooks
- Add list_webhooks() and register_webhook() methods to TinkClient
- Step 6 now shows: webhook flow diagram + curl examples + live API + sample payload
- Handle sandbox 404 gracefully (shows example data, no red error)
- Remove .env.production from git tracking (credentials via Gitea secrets)
- deploy.yml: write .env.production from TINK_CLIENT_ID/SECRET secrets

.gitea/workflows/deploy.yml

@@ -3,27 +3,53 @@ name: Build and Deploy
 on:
   push:
     branches: [main]
+  workflow_dispatch:
+
+env:
+  SERVICE_NAME: moneycapp-tink-demo
+  IMAGE: registry.i80.dk/gitea/moneycapp-tink-demo
 
 jobs:
-  build-and-deploy:
-    runs-on: ubuntu-latest
+  deploy:
+    runs-on: debian-host
+
+    env:
+      PATH: /usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/bin:/snap/bin
+      NOMAD_ADDR: "https://nomad.i80.dk:4646"
+
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@v4
 
-      - name: Build Docker image
-        run: docker build -t registry.i80.dk/moneycapp-tink-demo:latest .
-
-      - name: Push to i80 registry
+      - name: Log in to Docker Registry
         run: |
-          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login registry.i80.dk \
-            -u "${{ secrets.REGISTRY_USER }}" --password-stdin
-          docker push registry.i80.dk/moneycapp-tink-demo:latest
+          echo "${{ secrets.HARBOR_ROBOT_TOKEN }}" | docker login registry.i80.dk -u "robot\$gitserver" --password-stdin
+
+      - name: Write production env
+        run: |
+          cat > .env.production << 'ENVEOF'
+          TINK_CLIENT_ID=${{ secrets.TINK_CLIENT_ID }}
+          TINK_CLIENT_SECRET=${{ secrets.TINK_CLIENT_SECRET }}
+          TINK_REDIRECT_URI=https://tink-demo.i80.dk/callback
+          APP_BASE_URL=https://tink-demo.i80.dk
+          DEMO_MODE=false
+          ENVEOF
+          # Strip leading spaces
+          sed -i 's/^[[:space:]]*//' .env.production
+
+      - name: Build and push image
+        run: |
+          docker build -t ${IMAGE}:latest .
+          docker push ${IMAGE}:latest
+
+      - name: Validate Nomad job
+        run: nomad job validate ${SERVICE_NAME}.nomad
 
       - name: Deploy to Nomad
-        env:
-          NOMAD_ADDR: ${{ secrets.NOMAD_ADDR }}
-          NOMAD_TOKEN: ${{ secrets.NOMAD_TOKEN }}
+        run: nomad job run ${SERVICE_NAME}.nomad
+
+      - name: Health check
         run: |
-          curl -fsSL https://releases.hashicorp.com/nomad/1.8.0/nomad_1.8.0_linux_amd64.zip -o nomad.zip
-          unzip -q nomad.zip && chmod +x nomad
-          ./nomad job run moneycapp-tink-demo.nomad
+          sleep 15
+          curl -sf https://tink-demo.i80.dk/ || echo "Not yet reachable via Traefik"
+