auto-issue certs on nginx deploy, document one-domain-per-conf convention

CLAUDE.md

@@ -24,7 +24,8 @@ Actions workflows.
 - **App name = domain** (e.g., `hcsuzuki.net`)
 - **Container name** = domain with dots replaced by underscores (e.g., `hcsuzuki_net`)
 - **Image** = `git.timothykim.net/hantim/<domain>:latest`
-- **Cert name** = domain (at `/etc/letsencrypt/live/<domain>/`)
+- **Cert name** = config filename without `.conf` (at `/etc/letsencrypt/live/<name>/`)
+- **One domain per conf file** -- deploy.sh derives cert name from filename
 - All HTTP redirects to HTTPS; bare domain redirects to `www.<domain>`
 - The `shared` Docker network is created by nginx compose and used by all apps