auto-issue certs on nginx deploy, document one-domain-per-conf convention

ARCHITECTURE.md

@@ -114,7 +114,7 @@ Developer pushes to hantim-server
   -> deploy-<app>.yml triggers (based on changed paths under docker/<app>/)
     -> SSH to deploy@hantim as deploy-<app>
       -> deploy.sh: git pull, docker compose pull, docker compose up -d
-      -> (nginx only): test config with nginx -t before applying
+      -> (nginx only): auto-issues certs for new domains, then tests config with nginx -t
 ```
 
 ### Setup change (push to hantim-server)
@@ -131,7 +131,10 @@ Developer pushes change to scripts/configure.sh
 - **App name = domain** (e.g., `hcsuzuki.net`)
 - **Container name** = domain with dots replaced by underscores (e.g.,
   `hcsuzuki_net`)
-- **Cert name** = domain (stored at `/etc/letsencrypt/live/<domain>/`)
+- **Cert name** = config filename without `.conf` (stored at `/etc/letsencrypt/live/<name>/`)
+- **One domain per conf file** -- `deploy.sh` derives the cert name from the conf
+  filename and collects all `server_name` values for that cert. Putting unrelated
+  domains in the same conf file will bundle them into one cert incorrectly.
 - **Image name** = `git.timothykim.net/hantim/<domain>:latest`
 - All HTTP traffic redirects to `https://www.<domain>`
 - Bare domain HTTPS redirects to `https://www.<domain>`