add cert command to deploy.sh, use deploy user for cert issuance

- deploy.sh: add cert-<domain> command for zero-downtime SSL issuance
- new-app.sh: SSH as deploy user with key from Bitwarden instead of personal user
- remove DEPLOY_USER/DEPLOY_HOST env var requirements
- update all docs to reflect new flow

USECASES.md

@@ -15,6 +15,7 @@ bash /opt/hantim/setup.sh
 - Fetches secrets from Bitwarden (git-crypt key, registry token, deploy SSH key)
 - Unlocks git-crypt, logs into Docker registry
 - Creates deploy user with restricted SSH + sudo
+- Opens firewall ports (HTTP/HTTPS)
 - Issues SSL certs for all domains in `docker/nginx/conf.d/`
 - Starts nginx and all app containers
 
@@ -43,14 +44,14 @@ From your dev machine (single command):
 ```
 
 **Prerequisites:**
-- Bitwarden vault must contain `hantim-new-app-script` and `hantim-vultr-api-key`
+- Bitwarden vault must contain `hantim-new-app-script`, `hantim-vultr-api-key`,
+  and `hantim-server-deploy`
 - Domain nameservers must be pointed to Vultr (configured on directnic.com)
-- SSH access to the server as your user with passwordless sudo
 - Dependencies: `bw`, `jq`, `dig`
 
 **What happens (fully automated):**
 1. Resolves server IP from `hantim.net`
-2. Fetches Gitea API token and Vultr API key from Bitwarden
+2. Fetches Gitea API token, Vultr API key, and deploy SSH key from Bitwarden
 3. Creates DNS zone on Vultr (if needed) and A records for bare + www
 4. Waits for DNS to propagate
 5. Creates Gitea repo `hantim/hcsuzuki.net` from `static-site-template`
@@ -58,8 +59,7 @@ From your dev machine (single command):
    - `docker/hcsuzuki.net/compose.yml` (container name: `hcsuzuki_net`)
    - `.gitea/workflows/deploy-hcsuzuki.net.yml`
    - `docker/nginx/conf.d/hcsuzuki.net.conf` (HTTP->HTTPS, bare->www, proxy)
-7. SSHes to server: writes temporary HTTP-only nginx config, issues SSL cert
-   via webroot (zero downtime)
+7. SSHes to server as deploy user, issues SSL cert via webroot (zero downtime)
 8. Commits and pushes hantim-server (triggers deploy)
 9. Triggers initial build of the app repo via Gitea API
 10. Polls `https://www.hcsuzuki.net` until it responds (up to 3 minutes)