add cert command to deploy.sh, use deploy user for cert issuance

- deploy.sh: add cert-<domain> command for zero-downtime SSL issuance
- new-app.sh: SSH as deploy user with key from Bitwarden instead of personal user
- remove DEPLOY_USER/DEPLOY_HOST env var requirements
- update all docs to reflect new flow

scripts/deploy.sh

@@ -3,6 +3,34 @@ set -euo pipefail
 
 CMD="${SSH_ORIGINAL_COMMAND:-${1:-}}"
 
+if [[ "$CMD" =~ ^cert-[a-zA-Z0-9._-]+$ ]]; then
+    APP="${CMD#cert-}"
+
+    # Write temporary HTTP-only config so nginx can serve ACME challenges
+    cat > "/opt/hantim/docker/nginx/conf.d/$APP.conf" <<NGINXCONF
+server {
+    listen 80;
+    listen [::]:80;
+    server_name $APP www.$APP;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 444;
+    }
+}
+NGINXCONF
+
+    docker exec nginx nginx -t && docker exec nginx nginx -s reload
+    certbot certonly --webroot -w /opt/hantim/docker/nginx/certbot/www \
+        --non-interactive --agree-tos --register-unsafely-without-email \
+        --cert-name "$APP" -d "$APP" -d "www.$APP"
+    echo "Certificate issued for $APP"
+    exit 0
+fi
+
 if ! [[ "$CMD" =~ ^deploy-[a-zA-Z0-9._-]+$ ]]; then
     echo "Unknown command: $CMD"
     exit 1