migrate bootstrap.sh from bw to bws, update docs

ARCHITECTURE.md

@@ -21,18 +21,30 @@ A separate server running the Gitea instance. Provides:
 - Gitea Actions CI/CD (runner registered at site level)
 - Organization-level secrets and variables shared across repos
 
-### Bitwarden (cloud)
+### Bitwarden Secrets Manager (cloud)
 
-Bitwarden free tier is used as the secret store. Stores:
+Secrets are stored in Bitwarden Secrets Manager (free tier, project: `hantim`).
+The `bws` CLI fetches secrets using machine account access tokens.
 
-- `hantim-ci-registry-push` -- Gitea API token for registry access (Secure Note)
-- `hantim-server-deploy` -- deploy user SSH key pair (SSH Key)
-- `hantim-new-app-script` -- Gitea API token for creating repos (Secure Note)
-- `hantim-vultr-api-key` -- Vultr API key for DNS management (Secure Note)
-- `argento-garage` -- Garage rpc_secret, argento_node_id, S3 keys (Secure Note)
+- `hantim-ci-registry-push` -- Gitea API token for registry access
+- `hantim-deploy-ssh-private-key` -- deploy user SSH private key
+- `hantim-deploy-ssh-public-key` -- deploy user SSH public key
+- `hantim-new-app-script` -- Gitea API token for creating repos
+- `hantim-vultr-api-key` -- Vultr API key for DNS management
 
-The Bitwarden CLI (`bw`) is used in `bootstrap.sh` (on the server) and
-`new-app.sh` (on dev machines) to fetch secrets at runtime.
+Machine accounts:
+- `hantim-server` -- used by `bootstrap.sh` and `configure.sh` on the server
+  (access token at `/etc/bws-token`)
+- `hantim-ci` -- reserved for future CI use
+
+### Gitea secrets
+
+Workflow secrets stored in the `hantim` Gitea org. These duplicate some
+Bitwarden secrets for direct use in CI workflows without installing `bws`:
+
+- `DEPLOY_SSH_KEY` -- deploy SSH private key
+- `CI_REGISTRY_TOKEN` -- Gitea registry token
+- `DEPLOY_HOST` -- server IP (variable, not secret)
 
 ## Repos