docs site: add push-to-main polling deployer (agent host)

The agent host's cloud firewall only admits inbound SSH, so the registered
Gitea webhook cannot reach the receiver. docs-deploy-poll.service polls
Gitea every 60s over outbound HTTPS and deploys whenever main moves; the
webhook stays wired for the moment a port is opened in the Infomaniak panel.
Both serialise on the same deploy lock.

publishing/docs-deploy-poll.service

@@ -0,0 +1,35 @@
+# systemd units for the docs deploy automation (agent host).
+#
+# Two mechanisms, one job — keep https://docs.inference.coop/ in step with
+# co-op/docs main:
+#
+#   docs-deploy-poll.service      ALWAYS ON. Polls Gitea every 60s; deploys on
+#                                 any change to main. Works with the agent
+#                                 host's current firewall (outbound only).
+#
+#   docs-deploy-webhook.service   INSTALLED, INACTIVE UNTIL THE PORT IS OPEN.
+#                                 Instant push -> deploy once the Infomaniak
+#                                 panel allows inbound TCP to the agent host
+#                                 (the Gitea webhook is already registered).
+#
+# Install both:
+#   sudo cp publishing/poll-watcher.sh publishing/webhook-receiver.py /home/ubuntu/repos/docs/publishing/
+#   sudo cp publishing/docs-deploy-poll.service publishing/webhook-receiver.service /etc/systemd/system/
+#   sudo systemctl daemon-reload
+#   sudo systemctl enable --now docs-deploy-poll
+#   sudo systemctl enable --now docs-deploy-webhook   # when the port is open
+
+[Unit]
+Description=Inference docs: poll Gitea main and deploy to Surfer
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+User=ubuntu
+WorkingDirectory=/home/ubuntu/repos/docs
+ExecStart=/bin/bash /home/ubuntu/repos/docs/publishing/poll-watcher.sh
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target