auto-issue certs on nginx deploy, document one-domain-per-conf convention

USECASES.md

@@ -119,9 +119,16 @@ git push
 **What happens:**
 1. `deploy-nginx.yml` workflow triggers (path match)
 2. `deploy.sh` pulls latest code
-3. Tests nginx config with `nginx -t` -- if it fails, deploy aborts and the
+3. If any conf files reference certs that don't exist yet, nginx is briefly
+   stopped and certs are issued via standalone certbot (auto-restarts on failure)
+4. Tests nginx config with `nginx -t` -- if it fails, deploy aborts and the
    running nginx is untouched
-4. Runs `docker compose up -d` and reloads nginx
+5. Runs `docker compose up -d` and reloads nginx
+
+**Note:** Each conf file must contain server blocks for only one domain. The
+cert name is derived from the filename (e.g. `hcsuzuki.net.conf` -> cert
+`hcsuzuki.net`). Redirect-only domains like `hcsuzukiviolin.com` get their
+own conf file.
 
 ## 7. Re-run configure on existing server