move dev scripts to tools/, migrate to bws, use example.com in docs

- Move new-app.sh, new-service.sh, remove-app.sh from scripts/ to tools/
- Migrate new-app.sh and remove-app.sh from bw to bws
- Replace real domains with example.com in documentation and help text

ARCHITECTURE.md

@@ -59,8 +59,9 @@ configs, deploy scripts, and Gitea Actions workflows.
 scripts/bootstrap.sh              # First-time server setup (manual, uses Bitwarden)
 scripts/configure.sh              # Idempotent server config (CI-safe)
 scripts/deploy.sh                 # Receives deploy + cert + provision commands via SSH
-scripts/new-app.sh                # Scaffolds + deploys a new static site (single command)
-scripts/new-service.sh            # Scaffolds a new Docker Compose service
+tools/new-app.sh                  # Scaffolds + deploys a new static site (run from dev machine)
+tools/new-service.sh              # Scaffolds a new Docker Compose service (run from dev machine)
+tools/remove-app.sh               # Removes a static site (run from dev machine)
 docker/nginx/                     # nginx reverse proxy
   compose.yml                     # nginx:alpine container
   nginx.conf                      # Main nginx config
@@ -82,7 +83,7 @@ workflow that builds/pushes a Docker image and triggers a deploy.
 Uses Gitea template variables (`${REPO_NAME}`) so the image tag and deploy
 command are automatically set to the repo name.
 
-### App repos (e.g., timothykim.net)
+### App repos (e.g., example.com)
 
 Each app is its own repo created from `static-site-template`. Contains the
 app source code and a `build.yml` workflow.
@@ -96,7 +97,7 @@ app source code and a `build.yml` workflow.
                      |
             nginx (port 80/443)
               |          |
-    timothykim_net    hcsuzuki_net    ...
+    example_com    example_org    ...
        (shared Docker network)
 ```
 
@@ -111,7 +112,7 @@ app source code and a `build.yml` workflow.
 ### App code change (push to app repo)
 
 ```
-Developer pushes to app repo (e.g., timothykim.net)
+Developer pushes to app repo (e.g., example.com)
   -> build.yml workflow runs on Gitea runner
     -> docker build + push to git.timothykim.net registry
     -> SSH to deploy@hantim as deploy-<domain>
@@ -140,9 +141,9 @@ Developer pushes change to scripts/configure.sh
 
 ## Conventions
 
-- **App name = domain** (e.g., `hcsuzuki.net`)
+- **App name = domain** (e.g., `example.com`)
 - **Container name** = domain with dots replaced by underscores (e.g.,
-  `hcsuzuki_net`)
+  `example_com`)
 - **Cert name** = config filename without `.conf` (stored at `/etc/letsencrypt/live/<name>/`)
 - **One domain per conf file** -- `deploy.sh` derives the cert name from the conf
   filename and collects all `server_name` values for that cert. Putting unrelated