automate new-app.sh: DNS, cert, commit, build, verify

- resolve server IP from hantim.net instead of env var
- create Vultr DNS zone and A records via API
- wait for DNS propagation before cert issuance
- issue SSL cert via webroot (zero downtime)
- auto commit and push hantim-server
- trigger initial app build via Gitea API
- verify site is live with curl check
- update all docs to reflect single-command flow

USECASES.md

@@ -36,31 +36,35 @@ fresh server.
 
 ## 3. Add a new static site
 
-From your dev machine:
+From your dev machine (single command):
 
 ```bash
 ./scripts/new-app.sh hcsuzuki.net
 ```
 
-Then on the server, issue the SSL cert **before** pushing:
+**Prerequisites:**
+- Bitwarden vault must contain `hantim-new-app-script` and `hantim-vultr-api-key`
+- Domain nameservers must be pointed to Vultr (configured on directnic.com)
+- SSH access to the server as your user with passwordless sudo
+- Dependencies: `bw`, `jq`, `dig`
 
-```bash
-docker stop nginx
-certbot certonly --standalone --non-interactive --agree-tos \
-  --register-unsafely-without-email --cert-name hcsuzuki.net \
-  -d hcsuzuki.net -d www.hcsuzuki.net
-docker start nginx
-```
+**What happens (fully automated):**
+1. Resolves server IP from `hantim.net`
+2. Fetches Gitea API token and Vultr API key from Bitwarden
+3. Creates DNS zone on Vultr (if needed) and A records for bare + www
+4. Waits for DNS to propagate
+5. Creates Gitea repo `hantim/hcsuzuki.net` from `static-site-template`
+6. Creates local files:
+   - `docker/hcsuzuki.net/compose.yml` (container name: `hcsuzuki_net`)
+   - `.gitea/workflows/deploy-hcsuzuki.net.yml`
+   - `docker/nginx/conf.d/hcsuzuki.net.conf` (HTTP->HTTPS, bare->www, proxy)
+7. SSHes to server: writes temporary HTTP-only nginx config, issues SSL cert
+   via webroot (zero downtime)
+8. Commits and pushes hantim-server (triggers deploy)
+9. Triggers initial build of the app repo via Gitea API
+10. Polls `https://www.hcsuzuki.net` until it responds (up to 3 minutes)
 
-Then commit and push this repo:
-
-```bash
-git add docker/hcsuzuki.net/ .gitea/workflows/deploy-hcsuzuki.net.yml docker/nginx/conf.d/hcsuzuki.net.conf
-git commit -m "add hcsuzuki.net"
-git push
-```
-
-Finally, clone the new app repo, customize it, and push:
+After the site is live, clone the app repo and customize:
 
 ```bash
 git clone git@git.timothykim.net:hantim/hcsuzuki.net.git
@@ -69,12 +73,6 @@ cd hcsuzuki.net
 git add . && git commit -m "initial content" && git push
 ```
 
-**What the script creates:**
-- Gitea repo `hantim/hcsuzuki.net` (from `static-site-template`)
-- `docker/hcsuzuki.net/compose.yml` (container name: `hcsuzuki_net`)
-- `.gitea/workflows/deploy-hcsuzuki.net.yml`
-- `docker/nginx/conf.d/hcsuzuki.net.conf` (HTTP->HTTPS, bare->www, proxy)
-
 ## 4. Update app code
 
 Push a change to the app repo (e.g., `timothykim.net`):