split setup.sh into bootstrap.sh and configure.sh

bootstrap.sh handles first-time setup (manual, Bitwarden).
configure.sh handles idempotent config (CI-safe).
Add provision workflow, deploy-garage workflow, new-service.sh.
Remove git-crypt references and empty .gitattributes.

scripts/bootstrap.sh

@@ -0,0 +1,96 @@
+#!/bin/bash
+set -euo pipefail
+
+# First-time server setup for a fresh Rocky Linux 9 (or compatible) install.
+# Run as root after cloning the repo to /opt/hantim.
+# Calls configure.sh at the end.
+#
+# Usage:
+#   1. dnf install -y git
+#   2. git clone https://git.timothykim.net/hantim/hantim-server.git /opt/hantim
+#   3. bash /opt/hantim/scripts/bootstrap.sh
+#
+
+REPO_DIR="/opt/hantim"
+
+# --- Prerequisites ---
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "ERROR: Not running as root."
+    exit 1
+fi
+
+if [ "$(dirname "$(dirname "$(readlink -f "$0")")")" != "$REPO_DIR" ]; then
+    echo "ERROR: Repo does not appear to be cloned to $REPO_DIR."
+    echo "  git clone https://git.timothykim.net/hantim/hantim-server.git $REPO_DIR"
+    exit 1
+fi
+
+# --- Install dependencies ---
+
+echo "==> Upgrading system packages..."
+dnf upgrade -y
+
+echo "==> Installing dependencies..."
+dnf install -y jq epel-release
+dnf install -y certbot
+dnf module reset -y nodejs
+dnf module install -y nodejs:20/common
+
+BW_CLI="$(npm config get prefix)/bin/bw"
+if [ ! -x "$BW_CLI" ]; then
+    echo "==> Installing Bitwarden CLI..."
+    npm install -g @bitwarden/cli
+fi
+
+# --- Fetch secrets from Bitwarden ---
+
+echo "==> Fetching secrets from Bitwarden..."
+echo "    Log in to Bitwarden when prompted."
+if "$BW_CLI" status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
+    "$BW_CLI" login
+fi
+BW_SESSION=$("$BW_CLI" unlock --raw)
+"$BW_CLI" sync --session "$BW_SESSION"
+REGISTRY_TOKEN=$("$BW_CLI" get notes hantim-ci-registry-push --session "$BW_SESSION")
+DEPLOY_PUBKEY=$("$BW_CLI" get item hantim-server-deploy --session "$BW_SESSION" | jq -r '.sshKey.publicKey')
+"$BW_CLI" lock
+
+# --- Install Docker ---
+
+if ! command -v docker &>/dev/null; then
+    echo "==> Installing Docker..."
+    dnf install -y dnf-plugins-core
+    dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
+    dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
+fi
+systemctl enable --now docker
+
+echo "==> Logging into Gitea Docker registry..."
+echo "$REGISTRY_TOKEN" | docker login git.timothykim.net -u timothykim --password-stdin
+
+# --- Create deploy user ---
+
+if ! id deploy &>/dev/null; then
+    echo "==> Creating deploy user..."
+    useradd -r -s /usr/sbin/nologin deploy
+fi
+usermod -aG docker deploy
+
+echo "==> Setting up deploy SSH key..."
+mkdir -p /home/deploy/.ssh
+chmod 700 /home/deploy/.ssh
+echo "command=\"sudo /opt/hantim/scripts/deploy.sh \$SSH_ORIGINAL_COMMAND\",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty $DEPLOY_PUBKEY" > /home/deploy/.ssh/authorized_keys
+chmod 600 /home/deploy/.ssh/authorized_keys
+chown -R deploy:deploy /home/deploy/.ssh
+
+echo "==> Configuring sudo for deploy user..."
+cat > /etc/sudoers.d/deploy <<SUDOERS
+deploy ALL=(root) NOPASSWD: /opt/hantim/scripts/deploy.sh
+SUDOERS
+chmod 440 /etc/sudoers.d/deploy
+
+# --- Run configure ---
+
+echo "==> Running configure.sh..."
+bash "$REPO_DIR/scripts/configure.sh"