replace per-app deploy scripts with generic deploy.sh

Dispatch now validates the command format and routes to a single
deploy.sh that handles any app. This fixes first-deploy failures
for new apps (dispatch no longer needs a static case list) and
simplifies new-app.sh (no deploy script or dispatch update needed).

Also adds input validation to new-app.sh, set -euo pipefail to
deploy scripts, and dnf module reset before nodejs install.

setup.sh

@@ -33,6 +33,7 @@ dnf upgrade -y
 
 echo "==> Installing dependencies..."
 dnf install -y git-crypt
+dnf module reset -y nodejs
 dnf module install -y nodejs:20/common
 
 BW_CLI="$(npm config get prefix)/bin/bw"
@@ -44,7 +45,8 @@ fi
 # --- Unlock git-crypt via Bitwarden ---
 
 echo "==> Restoring git-tracked files..."
-cd "$REPO_DIR" && git checkout -- .
+cd "$REPO_DIR"
+git checkout -- .
 
 echo "==> Unlocking git-crypt via Bitwarden..."
 echo "    Log in to Bitwarden when prompted."
@@ -89,7 +91,7 @@ chown -R deploy:deploy /home/deploy/.ssh
 
 echo "==> Configuring sudo for deploy user..."
 cat > /etc/sudoers.d/deploy <<SUDOERS
-deploy ALL=(root) NOPASSWD: /opt/hantim/scripts/deploy-*.sh
+deploy ALL=(root) NOPASSWD: /opt/hantim/scripts/deploy.sh
 SUDOERS
 chmod 440 /etc/sudoers.d/deploy
 
@@ -102,8 +104,10 @@ echo "==> Logging into Gitea registry..."
 echo "Run manually: docker login git.timothykim.net"
 
 echo "==> Starting services..."
-cd "$REPO_DIR/docker/nginx" && docker compose up -d
-cd "$REPO_DIR/docker/timothykim.net" && docker compose up -d
+cd "$REPO_DIR/docker/nginx"
+docker compose up -d
+cd "$REPO_DIR/docker/timothykim.net"
+docker compose up -d
 
 echo "==> Done. Don't forget to:"
 echo "  1. Add the deploy SSH public key to /home/deploy/.ssh/authorized_keys"