automate new-app.sh: DNS, cert, commit, build, verify

- resolve server IP from hantim.net instead of env var
- create Vultr DNS zone and A records via API
- wait for DNS propagation before cert issuance
- issue SSL cert via webroot (zero downtime)
- auto commit and push hantim-server
- trigger initial app build via Gitea API
- verify site is live with curl check
- update all docs to reflect single-command flow

ARCHITECTURE.md

@@ -29,6 +29,7 @@ Bitwarden free tier is used as the secret store. Stores:
 - `hantim-ci-registry-push` -- Gitea API token for registry access (Secure Note)
 - `hantim-server-deploy` -- deploy user SSH key pair (SSH Key)
 - `hantim-new-app-script` -- Gitea API token for creating repos (Secure Note)
+- `hantim-vultr-api-key` -- Vultr API key for DNS management (Secure Note)
 
 The Bitwarden CLI (`bw`) is used in `setup.sh` (on the server) and
 `new-app.sh` (on dev machines) to fetch secrets at runtime.
@@ -45,7 +46,7 @@ configs, deploy scripts, and Gitea Actions workflows.
 ```
 setup.sh                          # Server provisioning (idempotent)
 scripts/deploy.sh                 # Receives deploy commands via SSH
-scripts/new-app.sh                # Scaffolds a new app (Gitea repo + local files)
+scripts/new-app.sh                # Scaffolds + deploys a new app (single command)
 docker/nginx/                     # nginx reverse proxy
   compose.yml                     # nginx:alpine container
   nginx.conf                      # Main nginx config