split setup.sh into bootstrap.sh and configure.sh

bootstrap.sh handles first-time setup (manual, Bitwarden).
configure.sh handles idempotent config (CI-safe).
Add provision workflow, deploy-garage workflow, new-service.sh.
Remove git-crypt references and empty .gitattributes.

ARCHITECTURE.md

@@ -7,7 +7,7 @@
 The production application server. Runs Rocky Linux 9 on Vultr.
 
 - Hosts all app containers and the nginx reverse proxy via Docker Compose
-- Provisioned by `setup.sh` in this repo
+- Provisioned by `bootstrap.sh` + `configure.sh` in this repo
 - This repo is cloned to `/opt/hantim`
 - The `deploy` user receives SSH commands from CI to trigger deploys
 - Certbot runs on the host (not in Docker) and manages Let's Encrypt certs
@@ -25,13 +25,13 @@ A separate server running the Gitea instance. Provides:
 
 Bitwarden free tier is used as the secret store. Stores:
 
-- `hantim-git-crypt-key` -- git-crypt symmetric key (Secure Note, base64)
 - `hantim-ci-registry-push` -- Gitea API token for registry access (Secure Note)
 - `hantim-server-deploy` -- deploy user SSH key pair (SSH Key)
 - `hantim-new-app-script` -- Gitea API token for creating repos (Secure Note)
 - `hantim-vultr-api-key` -- Vultr API key for DNS management (Secure Note)
+- `argento-garage` -- Garage rpc_secret, argento_node_id, S3 keys (Secure Note)
 
-The Bitwarden CLI (`bw`) is used in `setup.sh` (on the server) and
+The Bitwarden CLI (`bw`) is used in `bootstrap.sh` (on the server) and
 `new-app.sh` (on dev machines) to fetch secrets at runtime.
 
 ## Repos
@@ -44,15 +44,21 @@ This repo. Contains server provisioning, Docker Compose configs, nginx
 configs, deploy scripts, and Gitea Actions workflows.
 
 ```
-setup.sh                          # Server provisioning (idempotent)
-scripts/deploy.sh                 # Receives deploy + cert commands via SSH
-scripts/new-app.sh                # Scaffolds + deploys a new app (single command)
+scripts/bootstrap.sh              # First-time server setup (manual, uses Bitwarden)
+scripts/configure.sh              # Idempotent server config (CI-safe)
+scripts/deploy.sh                 # Receives deploy + cert + provision commands via SSH
+scripts/new-app.sh                # Scaffolds + deploys a new static site (single command)
+scripts/new-service.sh            # Scaffolds a new Docker Compose service
 docker/nginx/                     # nginx reverse proxy
   compose.yml                     # nginx:alpine container
   nginx.conf                      # Main nginx config
   conf.d/<domain>.conf            # Per-app server blocks
 docker/<domain>/compose.yml       # Per-app compose files
+docker/garage/                    # Garage S3-compatible object storage
+  compose.yml
+  garage.toml.template
 .gitea/workflows/deploy-<app>.yml # Per-app deploy workflows
+.gitea/workflows/provision.yml    # Triggers configure.sh on setup changes
 ```
 
 ### static-site-template
@@ -111,6 +117,15 @@ Developer pushes to hantim-server
       -> (nginx only): test config with nginx -t before applying
 ```
 
+### Setup change (push to hantim-server)
+
+```
+Developer pushes change to scripts/configure.sh
+  -> provision.yml triggers
+    -> SSH to deploy@hantim as provision
+      -> deploy.sh: git pull, configure.sh (firewall, certbot, start services)
+```
+
 ## Conventions
 
 - **App name = domain** (e.g., `hcsuzuki.net`)