fix deploy: use compose up instead of down+up, fetch secrets individually

- docker compose up -d --remove-orphans instead of down then up
- configure.sh delegates all service deployment to deploy.sh
- deploy.sh generates .env from bws before starting services
- remove 2>/dev/null from bws calls so errors are visible

scripts/deploy.sh

@@ -47,6 +47,30 @@ fi
 APP="${CMD#deploy-}"
 cd /opt/hantim
 git pull
+
+# Generate .env from bws if this service declares .env.keys
+if [ -f "docker/$APP/.env.keys" ] && [ -f /etc/bws-token ]; then
+    export BWS_ACCESS_TOKEN
+    BWS_ACCESS_TOKEN=$(cat /etc/bws-token)
+    env_content=""
+    while IFS= read -r line || [ -n "$line" ]; do
+        [ -z "$line" ] && continue
+        var_name="${line%%=*}"
+        secret_key="${line#*=}"
+        value=$(bws secret list | jq -r --arg key "$secret_key" '.[] | select(.key == $key) | .value')
+        if [ -z "$value" ]; then
+            echo "WARNING: Secret '$secret_key' not found in bws, skipping."
+            continue
+        fi
+        env_content="${env_content}${var_name}=${value}"$'\n'
+    done < "docker/$APP/.env.keys"
+    if [ -n "$env_content" ]; then
+        echo "Writing .env for $APP"
+        printf "%s" "$env_content" > "docker/$APP/.env"
+        chmod 600 "docker/$APP/.env"
+    fi
+fi
+
 cd "docker/$APP"
 if grep -q '^\s*build:' compose.yml 2>/dev/null; then
     docker compose build
@@ -89,8 +113,7 @@ if [ "$APP" = "nginx" ]; then
     docker compose run --rm -T nginx nginx -t
 fi
 
-docker compose down --remove-orphans
-docker compose up -d
+docker compose up -d --remove-orphans
 
 if [ "$APP" = "nginx" ]; then
     docker exec nginx nginx -s reload