remove standalone certbot fallback, fail on missing certs

scripts/deploy.sh

@@ -92,33 +92,15 @@ else
 fi
 
 if [ "$APP" = "nginx" ]; then
-    # Issue certs for any new domains (brief nginx downtime while certbot binds port 80)
-    missing_certs=false
+    # Fail loudly if any certs are missing — issue them first with: app.sh cert <domain>
     for conf in /opt/hantim/docker/nginx/conf.d/*.*.conf; do
         cert_name=$(basename "$conf" .conf)
         if [ ! -d "/etc/letsencrypt/live/$cert_name" ]; then
-            missing_certs=true
-            break
+            echo "ERROR: Missing certificate for $cert_name"
+            echo "  Run: app.sh cert $cert_name"
+            exit 1
         fi
     done
-    if [ "$missing_certs" = true ]; then
-        docker stop nginx 2>/dev/null || true
-        trap 'docker start nginx 2>/dev/null || true' EXIT
-        for conf in /opt/hantim/docker/nginx/conf.d/*.*.conf; do
-            cert_name=$(basename "$conf" .conf)
-            if [ ! -d "/etc/letsencrypt/live/$cert_name" ]; then
-                domains=$(grep -oP 'server_name\s+\K[^;]+' "$conf" | tr ' ' '\n' | sort -u)
-                domain_args=""
-                for d in $domains; do
-                    domain_args="$domain_args -d $d"
-                done
-                echo "Issuing cert for $cert_name..."
-                certbot certonly --standalone --non-interactive --agree-tos \
-                    --register-unsafely-without-email --cert-name "$cert_name" $domain_args
-            fi
-        done
-        trap - EXIT
-    fi
     # Test config before applying — a bad config would take down all sites
     docker compose run --rm -T nginx nginx -t
 fi