automate new-app.sh: DNS, cert, commit, build, verify

- resolve server IP from hantim.net instead of env var
- create Vultr DNS zone and A records via API
- wait for DNS propagation before cert issuance
- issue SSL cert via webroot (zero downtime)
- auto commit and push hantim-server
- trigger initial app build via Gitea API
- verify site is live with curl check
- update all docs to reflect single-command flow

CLAUDE.md

@@ -11,7 +11,7 @@ Actions workflows.
 
 - `setup.sh` -- Server provisioning (idempotent, run as root)
 - `scripts/deploy.sh` -- SSH-triggered deploy (validates command, pulls, restarts)
-- `scripts/new-app.sh` -- Scaffolds a new static site (Gitea repo + compose + workflow + nginx conf)
+- `scripts/new-app.sh` -- Single-command new app (DNS + Gitea repo + cert + deploy + verify)
 - `docker/nginx/` -- Reverse proxy (nginx:alpine + certbot on host)
 - `docker/<domain>/compose.yml` -- Per-app compose files
 - `.gitea/workflows/deploy-<app>.yml` -- Per-app deploy workflows
@@ -32,6 +32,7 @@ Stored in Bitwarden (free tier), fetched via `bw` CLI:
 - `hantim-ci-registry-push` -- Secure Note (Gitea registry token)
 - `hantim-server-deploy` -- SSH Key (deploy user key pair)
 - `hantim-new-app-script` -- Secure Note (Gitea API token for creating repos)
+- `hantim-vultr-api-key` -- Secure Note (Vultr API key for DNS management)
 
 Gitea org-level (`hantim`) secrets/variables:
 - `DEPLOY_HOST` -- Variable (server IP)
@@ -42,8 +43,9 @@ Gitea org-level (`hantim`) secrets/variables:
 
 ### Adding a new app
 
-Run `./scripts/new-app.sh <domain>` from dev machine, then issue SSL cert on
-server **before** pushing. See USECASES.md for full steps.
+Run `./scripts/new-app.sh <domain>` from dev machine. Handles everything:
+DNS, Gitea repo, SSL cert, commit/push, build trigger, and verification.
+See USECASES.md for full details.
 
 ### Editing scripts