add cert command to deploy.sh, use deploy user for cert issuance

- deploy.sh: add cert-<domain> command for zero-downtime SSL issuance
- new-app.sh: SSH as deploy user with key from Bitwarden instead of personal user
- remove DEPLOY_USER/DEPLOY_HOST env var requirements
- update all docs to reflect new flow

README.md

@@ -15,7 +15,7 @@ docker/
   timothykim.net/      # timothykim.net static site
     compose.yml
 scripts/
-  deploy.sh            # Deploy script (validates command, git pull, docker compose up)
+  deploy.sh            # Deploy + cert issuance script (called via SSH)
   new-app.sh           # Scaffolding script to add a new app
 setup.sh               # Server provisioning script (idempotent)
 .gitea/workflows/      # Per-app deploy workflows triggered by path changes
@@ -39,8 +39,9 @@ bash /opt/hantim/setup.sh
 4. Fetches the Docker registry token and deploy SSH public key from Bitwarden
 5. Logs into the Gitea Docker registry
 6. Creates the `deploy` user with restricted SSH access and sudo
-7. Issues SSL certificates via certbot for all configured domains
-8. Starts all services (nginx first, then all apps)
+7. Opens firewall ports (HTTP/HTTPS)
+8. Issues SSL certificates via certbot for all configured domains
+9. Starts all services (nginx first, then all apps)
 
 **Prerequisites**: DNS for all configured domains must point to the server
 before running setup.
@@ -59,7 +60,8 @@ the SSL cert (zero downtime), commits and pushes, triggers the first build,
 and verifies the site is live.
 
 **Prerequisites:** domain nameservers pointed to Vultr, `bw`/`jq`/`dig`
-installed, SSH access to the server. See USECASES.md for full details.
+installed. Uses the deploy SSH key from Bitwarden -- no personal server
+access needed. See USECASES.md for full details.
 
 After the site is live, clone the app repo and customize it: