feat(BLOCK-W): self-host Gluecron.com on Gluecron itself

feat(BLOCK-W): self-host Gluecron.com on Gluecron itself

Gluecron is a GitHub replacement, but its own source still lived on
GitHub. Today's entire day of pain — red Actions, manual SSH deploys,
AI safeguards not firing because they only apply to Gluecron-hosted
repos — was the bill coming due for that contradiction. This block
migrates Gluecron's source onto Gluecron. After the operator runs
the bootstrap on the box, every push to main fires the deploy
directly via Gluecron's own post-receive hook — no GitHub Actions
in the middle, ~25s to live.

Files
  scripts/self-host-bootstrap.ts (NEW, 518 lines)
    Idempotent one-shot orchestrator the operator SSH-runs once.
    Reads DATABASE_URL + GIT_REPOS_PATH from /etc/gluecron.env,
    looks up the site admin (or oldest user via bootstrap rule),
    creates the `repositories` row for ccantynz/Gluecron.com,
    `git init --bare` at /opt/gluecron/repos/ccantynz/Gluecron.com.git,
    `git push --mirror` from the GitHub source so Gluecron has every
    branch + tag + commit, then writes the self-deploy hook to the
    bare repo's hooks/post-receive (for SSH-receive-pack — the HTTP
    path already routes through onPostReceive).
    Prints clear cutover instructions for the operator.

  scripts/self-deploy.sh (NEW, 278 lines, +x)
    Fork-into-background deploy with notify-step events. Pulls
    latest, sources /etc/gluecron.env, bun install / migrate /
    build --compile, systemd restart, waits for healthz to be
    green (up to 30s), runs the post-deploy smoke suite from
    BLOCK S1+S3, rolls back via git reflog on failure. Logs to
    /var/log/gluecron-self-deploy.log.

  src/hooks/post-receive.ts (extended, additive)
    New "6. BLOCK W" block after the crontech path. Gated on env
    SELF_HOST_REPO (e.g. "ccantynz/Gluecron.com") and ref
    refs/heads/main. Forks self-deploy.sh with unref so git push
    returns immediately. __selfHostSpawn DI seam +
    __setSelfHostSpawnForTests export so the test suite can
    capture the spawn without actually shelling out.

  src/routes/admin-self-host.tsx (NEW, 499 lines)
    /admin/self-host dashboard. Three state pills:
    Mirrored / Installed / Set (env). Last 10 self-deploys table
    (platform_deploys WHERE source='self-deploy'). "Run bootstrap"
    button (disabled once mirrored + hook installed), audited
    as admin.self_host.bootstrap_triggered.

  src/app.tsx (+5)
    Mounts adminSelfHostRoutes.

  .gluecron/workflows/deploy.yml (rewritten)
    Delegates to /opt/gluecron/scripts/self-deploy.sh --inline.
    Kept as an OPTIONAL alternative to the post-receive path
    (which is the primary self-deploy mechanism).

  docs/SELF_HOST.md (NEW, 174 lines) — full runbook.

  src/__tests__/self-host.test.ts (NEW, 19 tests).
    Post-receive hook fires self-deploy only when SELF_HOST_REPO
    matches owner/repo AND ref is main; does NOT fire when env
    unset; does NOT fire on customer repos with same name; spawn
    is non-blocking; bootstrap idempotency; route auth.

Tests
  bun test → 1985 pass / 1 fail (pre-existing) / 2 skip across
  142 files.

Operator cutover (from docs/SELF_HOST.md):
  1. SSH to the box, run `bun run scripts/self-host-bootstrap.ts`.
  2. On laptop: `git remote set-url origin
     https://gluecron.com/ccantynz/Gluecron.com.git`.
  3. Same change in /opt/gluecron on the box.
  4. Add `SELF_HOST_REPO=ccantynz/Gluecron.com` to
     /etc/gluecron.env.
  5. Push a no-op commit to verify end-to-end.
  6. GitHub stays as a 7-day mirror; switch back via `git remote
     set-url` if anything breaks.

Pair with the upcoming BLOCK W2 which configures Claude itself
(.claude/settings.json + CLAUDE.md updates) to point at Gluecron's
MCP server instead of GitHub's.