simplify provisioning: setup.sh handles deps and git-crypt unlock

setup.sh now installs git-crypt, Bitwarden CLI, and fetches the
git-crypt key from a Bitwarden secure note. Initial setup is reduced
to just installing git, cloning, and running setup.sh.

README.md

@@ -24,16 +24,22 @@ setup.sh             # One-time server provisioning script
 On a fresh Rocky Linux 9 (or compatible) install:
 
 ```bash
-dnf install -y epel-release
-dnf install -y git git-crypt
-git clone <repo-url> /opt/hantim
-git-crypt unlock /path/to/git-crypt-key
+dnf install -y git
+git clone https://git.timothykim.net/timothykim/hantim-server.git /opt/hantim
 /opt/hantim/setup.sh
 ```
 
-`setup.sh` installs Docker, creates a `deploy` user, sets up the shared Docker
-network, and starts all services. See the script for the full list of post-setup
-steps (registry login, Nginx Proxy Manager config, etc.).
+`setup.sh` handles everything else: installs git-crypt and the Bitwarden CLI,
+fetches the git-crypt key from your Bitwarden vault (stored as a base64-encoded
+secure note named `hantim-git-crypt-key`), unlocks the repo, installs Docker,
+creates the `deploy` user, and starts all services.
+
+To save the git-crypt key to Bitwarden (one-time, from your dev machine):
+
+```bash
+base64 /path/to/git-crypt-key
+# Save the output as a Bitwarden secure note named "hantim-git-crypt-key"
+```
 
 ## How deploys work