replace NPM with vanilla nginx + certbot

- nginx:alpine replaces nginx-proxy-manager
- certbot on host with standalone issuance and auto-renewal
- per-site nginx configs in conf.d/ (HTTP->HTTPS, bare->www)
- container names use underscores (timothykim_net)
- setup.sh: automated cert issuance, dynamic app startup
- deploy.sh: nginx -t guard, graceful image-not-found
- new-app.sh: Gitea API repo creation, nginx conf generation
- add ARCHITECTURE.md, USECASES.md, CLAUDE.md
- remove old NPM data/certs from tracking

docker/nginx/compose.yml

@@ -1,17 +1,18 @@
 services:
-  app:
-    image: 'jc21/nginx-proxy-manager:latest'
+  nginx:
+    image: nginx:alpine
     restart: unless-stopped
-    container_name: npm
+    container_name: nginx
     networks:
       - shared
     ports:
       - '80:80'
       - '443:443'
-      - '81:81'
     volumes:
-      - ./data:/data
-      - ./certs:/etc/letsencrypt
+      - ./nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./conf.d:/etc/nginx/conf.d:ro
+      - /etc/letsencrypt:/etc/letsencrypt:ro
+      - ./certbot/www:/var/www/certbot:ro
 
 networks:
   shared: