feat(water-log): run Smartsheet sync via Gitea Actions cron + persist secrets on deploy

- New .gitea/workflows/smartsheet-cron.yml: hits POST /api/water-log/smartsheet-sync
  every 15min with SMARTSHEET_CRON_SECRET bearer. Replaces the no-op
  vercel.json cron entry (ignored on self-hosted Gitea).
- deploy.yml now writes SMARTSHEET_TOKEN_ENC_KEY and SMARTSHEET_CRON_SECRET
  to the runtime .env on every deploy so we don't silently lose them.
- Dropped the unused cron entry from vercel.json.

vercel.json

@@ -32,10 +32,6 @@
     {
       "path": "/api/cron/send-scheduled",
       "schedule": "0 9 * * *"
-    },
-    {
-      "path": "/api/water-log/smartsheet-sync",
-      "schedule": "*/15 * * * *"
     }
   ],
   "headers": [