replace NPM with vanilla nginx + certbot

- nginx:alpine replaces nginx-proxy-manager
- certbot on host with standalone issuance and auto-renewal
- per-site nginx configs in conf.d/ (HTTP->HTTPS, bare->www)
- container names use underscores (timothykim_net)
- setup.sh: automated cert issuance, dynamic app startup
- deploy.sh: nginx -t guard, graceful image-not-found
- new-app.sh: Gitea API repo creation, nginx conf generation
- add ARCHITECTURE.md, USECASES.md, CLAUDE.md
- remove old NPM data/certs from tracking

scripts/deploy.sh

@@ -12,5 +12,18 @@ APP="${CMD#deploy-}"
 cd /opt/hantim
 git pull
 cd "docker/$APP"
-docker compose pull
+if ! docker compose pull; then
+    echo "Image not yet available for $APP — skipping. It will deploy when the app repo is first pushed."
+    exit 0
+fi
+
+if [ "$APP" = "nginx" ]; then
+    # Test config before applying — a bad config (e.g. missing cert) would take down all sites
+    docker compose run --rm -T nginx nginx -t
+fi
+
 docker compose up -d
+
+if [ "$APP" = "nginx" ]; then
+    docker exec nginx nginx -s reload
+fi