remove standalone certbot fallback, fail on missing certs

ARCHITECTURE.md

@@ -91,8 +91,8 @@ client sends a command string (e.g., `deploy-example.com`), and `deploy.sh`
 parses it to determine the action:
 
 - `deploy-<app>` — deploy a specific app
-- `deploy-nginx` — deploy nginx (with cert handling)
-- `cert-<domain>` — issue a cert only
+- `deploy-nginx` — deploy nginx (fails if certs are missing)
+- `cert-<domain>` — issue a cert only (via `certbot --webroot`, zero downtime)
 - `provision` — run `configure.sh`
 
 ## SSL certificate handling
@@ -101,16 +101,9 @@ Cert names are derived from nginx conf filenames (e.g., `example.com.conf` →
 cert `example.com`). All `server_name` values in the conf are included in the
 cert as SANs.
 
-**New domain (nginx not yet running):**
-1. `deploy.sh` detects missing cert files
-2. Stops nginx temporarily
-3. Issues cert via `certbot --standalone`
-4. Starts nginx
-5. On error, cleans up the temp conf file (trap)
-
-**New domain (nginx already running):**
-1. Issues cert via `certbot --webroot` using the ACME challenge directory
-2. Zero downtime
+**New domain:** issue cert before deploying nginx config:
+1. Run `app.sh cert <domain>` (uses `certbot --webroot`, zero downtime)
+2. Deploy nginx config — `deploy.sh` verifies certs exist, fails if missing
 
 **Renewal:** certbot timer/cron runs daily, deploy hook reloads nginx.