docs(platform-tools): regista o deploy-on-push ligado (webhook Gitea id 6)

Master passa a deployar-se sozinho a cada push — webhook criado no
fitme3070.pt, AUTO_UPDATE_SECRET no .env do servidor,
system_settings.auto_update_enabled = 1. Fecha "produção sem
deploy-on-push" da auditoria (1.13/resumo Médio).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

PLATFORM_TOOLS.md

@@ -31,3 +31,15 @@ To bump the submodule to a newer platform-tools commit: `git submodule update
 --remote shared/platform-tools && git add shared/platform-tools && git commit`
 (see the platform-tools README, "Wiring up a platform", step 6) — same as
 fotografia.
+
+## Deploy-on-push
+
+`master` now deploys itself: Gitea webhook id 6 on `fitme3070.pt` (push, branch
+`master`) POSTs to `api/platform.php?endpoint=auto_update` (the router — no
+per-file `api/auto_update.php` stub needed, since the router's default target
+for that endpoint already resolves to the same
+`shared/platform-tools/api/auto_update.php` a stub would have required).
+`AUTO_UPDATE_SECRET` is in `.env` on the VPS (not in git — see
+`CLAUDE_GITEA/.auto-update-secrets` on Andre's machine), and
+`system_settings.auto_update_enabled = '1'`. Toggle it off from Sistema →
+Atualizar plataforma if a push needs to land without auto-deploying.