fix deploy: use compose up instead of down+up, fetch secrets individually

- docker compose up -d --remove-orphans instead of down then up
- configure.sh delegates all service deployment to deploy.sh
- deploy.sh generates .env from bws before starting services
- remove 2>/dev/null from bws calls so errors are visible

tools/new-app.sh

@@ -93,7 +93,7 @@ export BWS_ACCESS_TOKEN
 bws_get() {
     local name="$1"
     local value
-    value=$(bws secret list 2>/dev/null | jq -r --arg name "$name" '.[] | select(.key == $name) | .value')
+    value=$(bws secret list | jq -r --arg name "$name" '.[] | select(.key == $name) | .value')
     if [ -z "$value" ]; then
         echo "ERROR: Secret '$name' not found in Bitwarden Secrets Manager." >&2
         exit 1