add deploy scripts and Tor skeleton from nullcart.

Prod deploy, cert bootstrap/issue/renew, and onion hostname helper for docker-compose.prod.

deploy/scripts/renew-certs.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENV_FILE="${ROOT_DIR}/.env.prod"
+
+cd "$ROOT_DIR"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "Missing ${ENV_FILE}" >&2
+    exit 1
+fi
+
+mkdir -p "${ROOT_DIR}/deploy/certbot/www" "${ROOT_DIR}/deploy/certs"
+
+docker run --rm \
+    -v "${ROOT_DIR}/deploy/certbot/www:/var/www/certbot" \
+    -v "${ROOT_DIR}/deploy/certs:/etc/letsencrypt" \
+    certbot/certbot renew \
+    --webroot \
+    -w /var/www/certbot
+
+docker compose --env-file "$ENV_FILE" -f docker-compose.prod.yml exec nginx nginx -s reload
+
+echo "Certificate renewal complete; nginx reloaded."