audit fixes: error handling, docs consistency, bucket idempotency

scripts/deploy.sh

@@ -23,11 +23,13 @@ server {
 }
 NGINXCONF
 
+    trap 'rm -f "/opt/hantim/docker/nginx/conf.d/$APP.conf"' EXIT
     docker exec nginx nginx -t && docker exec nginx nginx -s reload
     certbot certonly --webroot -w /opt/hantim/docker/nginx/certbot/www \
         --non-interactive --agree-tos --register-unsafely-without-email \
         --cert-name "$APP" -d "$APP" -d "www.$APP"
     rm -f "/opt/hantim/docker/nginx/conf.d/$APP.conf"
+    trap - EXIT
     echo "Certificate issued for $APP"
     exit 0
 fi
@@ -59,8 +61,9 @@ if [ -f "docker/$APP/.env.keys" ] && [ -f /etc/bws-token ]; then
         secret_key="${line#*=}"
         value=$(bws secret list | jq -r --arg key "$secret_key" '.[] | select(.key == $key) | .value')
         if [ -z "$value" ]; then
-            echo "WARNING: Secret '$secret_key' not found in bws, skipping."
-            continue
+            echo "ERROR: Secret '$secret_key' not found in bws."
+            echo "  Check that the secret exists and the machine account has access."
+            exit 1
         fi
         env_content="${env_content}${var_name}=${value}"$'\n'
     done < "docker/$APP/.env.keys"