split setup.sh into bootstrap.sh and configure.sh

bootstrap.sh handles first-time setup (manual, Bitwarden).
configure.sh handles idempotent config (CI-safe).
Add provision workflow, deploy-garage workflow, new-service.sh.
Remove git-crypt references and empty .gitattributes.

USECASES.md

@@ -7,22 +7,22 @@ Set up a fresh Rocky Linux 9 server from scratch.
 ```bash
 dnf install -y git
 git clone https://git.timothykim.net/hantim/hantim-server.git /opt/hantim
-bash /opt/hantim/setup.sh
+bash /opt/hantim/scripts/bootstrap.sh
 ```
 
 **What happens:**
-- Installs all dependencies (git-crypt, jq, certbot, Node.js 20, Docker, bw CLI)
-- Fetches secrets from Bitwarden (git-crypt key, registry token, deploy SSH key)
-- Unlocks git-crypt, logs into Docker registry
+- Installs all dependencies (jq, certbot, Node.js 20, Docker, bw CLI)
+- Fetches secrets from Bitwarden (registry token, deploy SSH key)
+- Logs into Docker registry
 - Creates deploy user with restricted SSH + sudo
-- Opens firewall ports (HTTP/HTTPS)
-- Issues SSL certs for all domains in `docker/nginx/conf.d/`
-- Starts nginx and all app containers
+- Runs `configure.sh`:
+  - Opens firewall ports (HTTP, HTTPS, Garage RPC)
+  - Issues SSL certs for all domains in `docker/nginx/conf.d/`
+  - Starts nginx and all app containers
 
 **Prerequisites:**
 - DNS for all configured domains must point to the server
-- Bitwarden vault must contain: `hantim-git-crypt-key`, `hantim-ci-registry-push`,
-  `hantim-server-deploy`
+- Bitwarden vault must contain: `hantim-ci-registry-push`, `hantim-server-deploy`
 - Docker images must exist in the Gitea registry (or apps will start on next push)
 
 ## 2. Restore from backup
@@ -30,7 +30,7 @@ bash /opt/hantim/setup.sh
 Identical to provisioning a new server. Run the same three commands on a
 fresh server.
 
-- `setup.sh` is idempotent -- safe to re-run
+- `bootstrap.sh` and `configure.sh` are idempotent -- safe to re-run
 - SSL certs are re-issued automatically (Let's Encrypt)
 - Docker images are pulled from the Gitea registry
 - No data migration needed for stateless static sites
@@ -123,16 +123,19 @@ git push
    running nginx is untouched
 4. Runs `docker compose up -d` and reloads nginx
 
-## 7. Re-run setup on existing server
+## 7. Re-run configure on existing server
 
-Safe to do at any time:
+Safe to do at any time, manually or via CI:
 
 ```bash
 cd /opt/hantim
 git pull
-bash setup.sh
+bash scripts/configure.sh
 ```
 
+Or push a change to `scripts/configure.sh` — the `provision.yml` workflow
+triggers automatically.
+
 - All steps are idempotent
 - Existing certs are skipped
 - Brief nginx downtime (seconds) while certbot checks run