add cert command to deploy.sh, use deploy user for cert issuance

- deploy.sh: add cert-<domain> command for zero-downtime SSL issuance
- new-app.sh: SSH as deploy user with key from Bitwarden instead of personal user
- remove DEPLOY_USER/DEPLOY_HOST env var requirements
- update all docs to reflect new flow

ARCHITECTURE.md

@@ -45,7 +45,7 @@ configs, deploy scripts, and Gitea Actions workflows.
 
 ```
 setup.sh                          # Server provisioning (idempotent)
-scripts/deploy.sh                 # Receives deploy commands via SSH
+scripts/deploy.sh                 # Receives deploy + cert commands via SSH
 scripts/new-app.sh                # Scaffolds + deploys a new app (single command)
 docker/nginx/                     # nginx reverse proxy
   compose.yml                     # nginx:alpine container