add cert command to deploy.sh, use deploy user for cert issuance

- deploy.sh: add cert-<domain> command for zero-downtime SSL issuance
- new-app.sh: SSH as deploy user with key from Bitwarden instead of personal user
- remove DEPLOY_USER/DEPLOY_HOST env var requirements
- update all docs to reflect new flow

CLAUDE.md

@@ -10,7 +10,7 @@ Actions workflows.
 ## Key files
 
 - `setup.sh` -- Server provisioning (idempotent, run as root)
-- `scripts/deploy.sh` -- SSH-triggered deploy (validates command, pulls, restarts)
+- `scripts/deploy.sh` -- SSH-triggered deploy + cert issuance (deploy-* and cert-* commands)
 - `scripts/new-app.sh` -- Single-command new app (DNS + Gitea repo + cert + deploy + verify)
 - `docker/nginx/` -- Reverse proxy (nginx:alpine + certbot on host)
 - `docker/<domain>/compose.yml` -- Per-app compose files