replace per-app deploy scripts with generic deploy.sh

Dispatch now validates the command format and routes to a single
deploy.sh that handles any app. This fixes first-deploy failures
for new apps (dispatch no longer needs a static case list) and
simplifies new-app.sh (no deploy script or dispatch update needed).

Also adds input validation to new-app.sh, set -euo pipefail to
deploy scripts, and dnf module reset before nodejs install.

README.md

@@ -11,9 +11,8 @@ docker/              # One directory per app, each with a compose.yml
   nginx/             # Nginx Proxy Manager (reverse proxy + TLS)
   timothykim.net/    # timothykim.net static site
 scripts/
-  deploy-dispatch.sh # SSH command dispatcher (routes to per-app deploy scripts)
-  deploy-nginx.sh    # Deploy script for nginx
-  deploy-timothykim.sh  # Deploy script for timothykim.net
+  deploy-dispatch.sh # SSH command dispatcher (validates and routes deploy commands)
+  deploy.sh          # Generic deploy script (git pull + docker compose up)
   new-app.sh         # Scaffolding script to add a new app
 setup.sh             # One-time server provisioning script
 .gitea/workflows/    # Per-app deploy workflows triggered by path changes
@@ -43,16 +42,15 @@ base64 /path/to/git-crypt-key
 
 ## How deploys work
 
-Each app has three components:
+Each app has two components:
 
-1. **Deploy script** (`scripts/deploy-<app>.sh`) -- pulls the latest repo
-   changes, then runs `docker compose pull && up -d` for that app.
-2. **Gitea Actions workflow** (`.gitea/workflows/deploy-<app>.yml`) -- triggers
+1. **Gitea Actions workflow** (`.gitea/workflows/deploy-<app>.yml`) -- triggers
    on pushes to `main` when files under `docker/<app>/` change. SSHes into the
    server as the `deploy` user to trigger the deploy.
-3. **SSH dispatcher** (`scripts/deploy-dispatch.sh`) -- the `deploy` user's
+2. **SSH dispatcher** (`scripts/deploy-dispatch.sh`) -- the `deploy` user's
    `authorized_keys` is locked to this script via a `command=` directive. It
-   reads `SSH_ORIGINAL_COMMAND` to route to the correct per-app deploy script.
+   validates the command and runs `scripts/deploy.sh`, which pulls the latest
+   repo changes and runs `docker compose pull && up -d` for that app.
 
 This means:
 
@@ -72,9 +70,7 @@ This creates:
 
 - `docker/<app-name>/compose.yml` -- a starter compose file on the `shared`
   network
-- `scripts/deploy-<app-name>.sh` -- the deploy script
 - `.gitea/workflows/deploy-<app-name>.yml` -- the Gitea Actions workflow
-- A new case in `scripts/deploy-dispatch.sh`
 
 After running the script: