split setup.sh into bootstrap.sh and configure.sh

bootstrap.sh handles first-time setup (manual, Bitwarden).
configure.sh handles idempotent config (CI-safe).
Add provision workflow, deploy-garage workflow, new-service.sh.
Remove git-crypt references and empty .gitattributes.

CLAUDE.md

@@ -9,12 +9,15 @@ Actions workflows.
 
 ## Key files
 
-- `setup.sh` -- Server provisioning (idempotent, run as root)
-- `scripts/deploy.sh` -- SSH-triggered deploy + cert issuance (deploy-* and cert-* commands)
-- `scripts/new-app.sh` -- Single-command new app (DNS + Gitea repo + cert + deploy + verify)
+- `scripts/bootstrap.sh` -- First-time server setup (manual, uses Bitwarden)
+- `scripts/configure.sh` -- Idempotent server config (firewall, certbot, start services; CI-safe)
+- `scripts/deploy.sh` -- SSH-triggered deploy + cert issuance + provision (deploy-*, cert-*, provision commands)
+- `scripts/new-app.sh` -- Single-command new static site (DNS + Gitea repo + cert + deploy + verify)
+- `scripts/new-service.sh` -- Scaffold a new Docker Compose service (compose + workflow)
 - `docker/nginx/` -- Reverse proxy (nginx:alpine + certbot on host)
 - `docker/<domain>/compose.yml` -- Per-app compose files
 - `.gitea/workflows/deploy-<app>.yml` -- Per-app deploy workflows
+- `.gitea/workflows/provision.yml` -- Triggers configure.sh on setup changes
 
 ## Conventions
 
@@ -28,11 +31,11 @@ Actions workflows.
 ## Secrets
 
 Stored in Bitwarden (free tier), fetched via `bw` CLI:
-- `hantim-git-crypt-key` -- Secure Note (base64)
 - `hantim-ci-registry-push` -- Secure Note (Gitea registry token)
 - `hantim-server-deploy` -- SSH Key (deploy user key pair)
 - `hantim-new-app-script` -- Secure Note (Gitea API token for creating repos)
 - `hantim-vultr-api-key` -- Secure Note (Vultr API key for DNS management)
+- `argento-garage` -- Secure Note (Garage rpc_secret, argento_node_id, S3 keys)
 
 Gitea org-level (`hantim`) secrets/variables:
 - `DEPLOY_HOST` -- Variable (server IP)
@@ -41,16 +44,21 @@ Gitea org-level (`hantim`) secrets/variables:
 
 ## Working with this repo
 
-### Adding a new app
+### Adding a new static site
 
 Run `./scripts/new-app.sh <domain>` from dev machine. Handles everything:
 DNS, Gitea repo, SSL cert, commit/push, build trigger, and verification.
 See USECASES.md for full details.
 
+### Adding a new Docker service
+
+Run `./scripts/new-service.sh <name>` to scaffold the compose file and deploy
+workflow, then edit the compose file and commit.
+
 ### Editing scripts
 
 All shell scripts use `set -euo pipefail`. Keep all steps idempotent.
-`setup.sh` must be safe to re-run on an existing server.
+`configure.sh` must be safe to re-run from CI.
 
 ### Deploy flow
 
@@ -60,6 +68,9 @@ App repo push -> `build.yml` builds image, pushes to registry, SSHes to server
 Infrastructure push (this repo) -> `deploy-<app>.yml` triggers on path match
 -> same `deploy.sh` flow. nginx deploys test config with `nginx -t` first.
 
+Setup change push -> `provision.yml` triggers -> `deploy.sh provision`
+-> `configure.sh` (firewall, certbot, start services).
+
 ## Build and test
 
 No build step. No tests. Verify changes by: