replace NPM with vanilla nginx + certbot

- nginx:alpine replaces nginx-proxy-manager
- certbot on host with standalone issuance and auto-renewal
- per-site nginx configs in conf.d/ (HTTP->HTTPS, bare->www)
- container names use underscores (timothykim_net)
- setup.sh: automated cert issuance, dynamic app startup
- deploy.sh: nginx -t guard, graceful image-not-found
- new-app.sh: Gitea API repo creation, nginx conf generation
- add ARCHITECTURE.md, USECASES.md, CLAUDE.md
- remove old NPM data/certs from tracking

setup.sh

@@ -32,7 +32,8 @@ echo "==> Upgrading system packages..."
 dnf upgrade -y
 
 echo "==> Installing dependencies..."
-dnf install -y git-crypt jq
+dnf install -y git-crypt jq epel-release
+dnf install -y certbot
 dnf module reset -y nodejs
 dnf module install -y nodejs:20/common
 
@@ -104,12 +105,57 @@ chmod 440 /etc/sudoers.d/deploy
 echo "==> Making scripts executable..."
 chmod +x "$REPO_DIR/scripts/"*.sh
 
+echo "==> Setting up certbot..."
+mkdir -p "$REPO_DIR/docker/nginx/certbot/www"
+mkdir -p /etc/letsencrypt/renewal-hooks/deploy
+cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'HOOK'
+#!/bin/bash
+docker exec nginx nginx -s reload
+HOOK
+chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
+if systemctl list-unit-files certbot-renew.timer 2>/dev/null | grep -q certbot-renew; then
+    systemctl enable --now certbot-renew.timer
+else
+    echo "0 3 * * * root certbot renew --quiet" > /etc/cron.d/certbot-renew
+fi
+
+echo "==> Issuing SSL certificates..."
+# Stop nginx if running so certbot can bind to port 80
+docker stop nginx 2>/dev/null || true
+for conf in "$REPO_DIR"/docker/nginx/conf.d/*.conf; do
+    # Derive cert name from config filename (e.g. timothykim.net.conf -> timothykim.net)
+    cert_name=$(basename "$conf" .conf)
+    domains=$(grep -oP 'server_name\s+\K[^;]+' "$conf" | tr ' ' '\n' | sort -u)
+    if [ -z "$domains" ]; then
+        continue
+    fi
+    if [ -d "/etc/letsencrypt/live/$cert_name" ]; then
+        echo "  Cert for $cert_name already exists, skipping."
+        continue
+    fi
+    domain_args=""
+    for d in $domains; do
+        domain_args="$domain_args -d $d"
+    done
+    echo "  Issuing cert for: $cert_name ($domains)"
+    certbot certonly --standalone --non-interactive --agree-tos --register-unsafely-without-email --cert-name "$cert_name" $domain_args
+done
+
 echo "==> Starting services..."
+# Start nginx first (creates the shared network)
 cd "$REPO_DIR/docker/nginx"
 docker compose up -d
-cd "$REPO_DIR/docker/timothykim.net"
-docker compose up -d
+# Start all other apps
+for app in "$REPO_DIR"/docker/*/; do
+    if [ "$(basename "$app")" = "nginx" ]; then
+        continue
+    fi
+    app_name=$(basename "$app")
+    echo "  Starting $app_name..."
+    cd "$app"
+    if ! docker compose up -d; then
+        echo "  WARNING: Failed to start $app_name (image may not exist yet). It will start on first deploy."
+    fi
+done
 
-echo "==> Done. Don't forget to:"
-echo "  1. Configure Nginx Proxy Manager at http://<server-ip>:81"
-echo "  2. Restore NPM data/certs backup if migrating"
+echo "==> Done."