add nginx and cert subcommands to service.sh

USECASES.md

@@ -89,7 +89,20 @@ for stateless static sites.
 - Existing certs skipped
 - Services restarted
 
-## 8. Upload media files
+## 8. Add a new Docker service
+
+**Trigger:** `./tools/service.sh all <name> <port>` from dev machine.
+
+**Prerequisites:** `bws`/`jq`/`dig` installed.
+
+**Expected outcome:**
+- DNS A record created for `<name>.hantim.net`
+- Compose file and deploy workflow scaffolded
+- Nginx conf created proxying `<name>.hantim.net` to port `<port>`
+- SSL cert issued for `<name>.hantim.net` (no www variant)
+- Service ready for customization (edit compose.yml image, add `.env.keys` if needed)
+
+## 9. Upload media files
 
 **Trigger:** `aws s3 cp` or `aws s3 sync` to `s3://example.com/`.