automate new-app.sh: DNS, cert, commit, build, verify

- resolve server IP from hantim.net instead of env var
- create Vultr DNS zone and A records via API
- wait for DNS propagation before cert issuance
- issue SSL cert via webroot (zero downtime)
- auto commit and push hantim-server
- trigger initial app build via Gitea API
- verify site is live with curl check
- update all docs to reflect single-command flow

README.md

@@ -53,26 +53,22 @@ before running setup.
 
 Example: `./scripts/new-app.sh hcsuzuki.net`
 
-This creates:
+This single command handles everything: creates DNS records on Vultr, creates
+the Gitea repo from `static-site-template`, generates all config files, issues
+the SSL cert (zero downtime), commits and pushes, triggers the first build,
+and verifies the site is live.
 
-- A Gitea repo (`hantim/<domain>`) from the `static-site-template`
-- `docker/<domain>/compose.yml` -- app compose file
-- `.gitea/workflows/deploy-<domain>.yml` -- deploy workflow
-- `docker/nginx/conf.d/<domain>.conf` -- nginx proxy config (HTTP->HTTPS,
-  bare domain->www)
+**Prerequisites:** domain nameservers pointed to Vultr, `bw`/`jq`/`dig`
+installed, SSH access to the server. See USECASES.md for full details.
 
-After running the script:
+After the site is live, clone the app repo and customize it:
 
-1. Issue the SSL cert on the server (**before** pushing):
-   ```bash
-   docker stop nginx
-   certbot certonly --standalone --non-interactive --agree-tos \
-     --register-unsafely-without-email --cert-name <domain> \
-     -d <domain> -d www.<domain>
-   docker start nginx
-   ```
-2. Commit and push this repo to deploy
-3. Clone the new app repo, customize it, and push to build/deploy
+```bash
+git clone git@git.timothykim.net:hantim/<domain>.git
+cd <domain>
+# edit content
+git add . && git commit -m "initial content" && git push
+```
 
 ## Deploying changes
 
@@ -110,8 +106,9 @@ The following are configured in the `hantim` Gitea org settings:
 | `DEPLOY_SSH_KEY` | Secret | SSH private key for the deploy user |
 | `CI_REGISTRY_TOKEN` | Secret | Gitea token for Docker registry login |
 
-The following is stored in Bitwarden and used by `new-app.sh`:
+The following are stored in Bitwarden and used by `new-app.sh`:
 
 | Bitwarden item | Type | Purpose |
 |---|---|---|
 | `hantim-new-app-script` | Secure Note | Gitea API token for creating repos |
+| `hantim-vultr-api-key` | Secure Note | Vultr API key for DNS management |