split setup.sh into bootstrap.sh and configure.sh

bootstrap.sh handles first-time setup (manual, Bitwarden).
configure.sh handles idempotent config (CI-safe).
Add provision workflow, deploy-garage workflow, new-service.sh.
Remove git-crypt references and empty .gitattributes.

scripts/deploy.sh

@@ -32,6 +32,13 @@ NGINXCONF
     exit 0
 fi
 
+if [ "$CMD" = "provision" ]; then
+    cd /opt/hantim
+    git pull
+    bash scripts/configure.sh
+    exit 0
+fi
+
 if ! [[ "$CMD" =~ ^deploy-[a-zA-Z0-9._-]+$ ]]; then
     echo "Unknown command: $CMD"
     exit 1