fix: step 6 webhooks demo - replace 404 events API with webhook registration flow

- Replace /events/v2/* endpoints (404 in sandbox) with /api/v1/webhooks
- Add list_webhooks() and register_webhook() methods to TinkClient
- Step 6 now shows: webhook flow diagram + curl examples + live API + sample payload
- Handle sandbox 404 gracefully (shows example data, no red error)
- Remove .env.production from git tracking (credentials via Gitea secrets)
- deploy.yml: write .env.production from TINK_CLIENT_ID/SECRET secrets

moneycapp-tink-demo.nomad

@@ -28,21 +28,10 @@ job "moneycapp-tink-demo" {
       driver = "docker"
 
       config {
-        image = "registry.i80.dk/moneycapp-tink-demo:latest"
+        image = "registry.i80.dk/gitea/moneycapp-tink-demo:latest"
         ports = ["http"]
       }
 
-      env {
-        TINK_CLIENT_ID    = "f168ab67fc2a413a8bd1e9ec62583392"
-        TINK_CLIENT_SECRET = "87f9ef0f49b54a1282f7969b85719f34"
-        TINK_REDIRECT_URI = "https://tink-demo.i80.dk/callback"
-        APP_BASE_URL      = "https://tink-demo.i80.dk"
-        SESSION_SECRET    = "moneycapp-tink-demo-i80-2026"
-        TINK_API_BASE     = "https://api.tink.com"
-        TINK_LINK_BASE    = "https://link.tink.com"
-        DEMO_MODE         = "false"
-      }
-
       resources {
         cpu    = 256
         memory = 256