add cert command to deploy.sh, use deploy user for cert issuance

- deploy.sh: add cert-<domain> command for zero-downtime SSL issuance
- new-app.sh: SSH as deploy user with key from Bitwarden instead of personal user
- remove DEPLOY_USER/DEPLOY_HOST env var requirements
- update all docs to reflect new flow

scripts/new-app.sh

@@ -9,8 +9,7 @@ if [ -z "${1:-}" ]; then
     echo "Usage: ./scripts/new-app.sh <domain>"
     echo "  Example: ./scripts/new-app.sh hcsuzuki.net"
     echo ""
-    echo "Requires environment variables:"
-    echo "  DEPLOY_USER  - SSH username (default: \$USER)"
+    echo "Requires: bw, jq, dig"
     exit 1
 fi
 
@@ -23,8 +22,6 @@ if [ -z "$SERVER_IP" ]; then
     exit 1
 fi
 
-SSH_TARGET="${DEPLOY_USER:-$USER}@$SERVER_IP"
-
 if ! [[ "$APP" =~ ^[a-zA-Z0-9][a-zA-Z0-9._-]*$ ]]; then
     echo "Error: app name must be alphanumeric (hyphens, dots, underscores allowed)."
     exit 1
@@ -72,6 +69,12 @@ fi
 bw sync --session "${BW_SESSION:-}"
 GITEA_TOKEN=$(bw get notes hantim-new-app-script --session "${BW_SESSION:-}")
 VULTR_API_KEY=$(bw get notes hantim-vultr-api-key --session "${BW_SESSION:-}")
+DEPLOY_KEY=$(bw get item hantim-server-deploy --session "${BW_SESSION:-}" | jq -r '.sshKey.privateKey')
+
+DEPLOY_KEY_FILE=$(mktemp)
+echo "$DEPLOY_KEY" > "$DEPLOY_KEY_FILE"
+chmod 600 "$DEPLOY_KEY_FILE"
+trap "rm -f $DEPLOY_KEY_FILE" EXIT
 
 # --- Set up DNS records on Vultr ---
 
@@ -259,25 +262,8 @@ NGINX
 
 # --- Issue SSL cert (zero downtime) ---
 
-echo "==> Writing temporary HTTP-only config on server..."
-TEMP_CONF="server {
-    listen 80;
-    listen [::]:80;
-    server_name $APP www.$APP;
-
-    location /.well-known/acme-challenge/ {
-        root /var/www/certbot;
-    }
-
-    location / {
-        return 444;
-    }
-}"
-echo "$TEMP_CONF" | ssh "$SSH_TARGET" "sudo tee /opt/hantim/docker/nginx/conf.d/$APP.conf > /dev/null"
-ssh "$SSH_TARGET" "sudo docker exec nginx nginx -t && sudo docker exec nginx nginx -s reload"
-
-echo "==> Issuing SSL certificate..."
-ssh "$SSH_TARGET" "sudo certbot certonly --webroot -w /opt/hantim/docker/nginx/certbot/www --non-interactive --agree-tos --register-unsafely-without-email --cert-name $APP -d $APP -d www.$APP"
+echo "==> Issuing SSL certificate via deploy user..."
+ssh -o StrictHostKeyChecking=accept-new -i "$DEPLOY_KEY_FILE" deploy@"$SERVER_IP" "cert-$APP"
 
 # --- Commit and push ---
 
@@ -310,4 +296,4 @@ echo "WARNING: https://www.$APP is not responding after 3 minutes."
 echo "  Check that:"
 echo "    - DNS for $APP and www.$APP points to $SERVER_IP"
 echo "    - The build completed: $GITEA_URL/$GITEA_ORG/$APP/actions"
-echo "    - The container is running: ssh $SSH_TARGET sudo docker ps"
+echo "    - The container is running on the server: docker ps"