Add domain and TLS management via skiff domains add/remove/list

Replaces the single server_name string in meta.json with a domain list
(one primary, others redirect to it) and TLSDomains tracking what the
app's certificate actually covers. Certs are issued/expanded via certbot
certonly (webroot, never the --nginx plugin, since Skiff owns and
regenerates skiff.d/*.conf itself) as one SAN cert per app, matching how
a real multi-domain vhost is normally issued.

Domain/TLS changes never touch the jail - no restart, no health check -
since they only affect nginx and the certificate. `add` is safe to retry
if DNS isn't ready yet; `remove` never calls certbot at all, so it can't
fail on an ACME/network problem.

Also updates README/USER_GUIDE for the new command surface, one-time TLS
host setup (certbot register, renewal cron, reload hook), the --ip
same-subnet requirement for jails to reach the network at build time, and
the actual base-image provisioning sequence (pkg needs an explicit
bootstrap after bsdinstall; versioned port names like go125 need a
default symlink) - all found and fixed live while getting this working
end-to-end on a real FreeBSD VM.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 17 insertions, 4 deletions

diff --git a/internal/tmpl/tmpl.go b/internal/tmpl/tmpl.go
index 12baa70..0213919 100644
--- a/internal/tmpl/tmpl.go
+++ b/internal/tmpl/tmpl.go
@@ -46,11 +46,24 @@ type RCData struct{ Name string }
 
 func RCScript(d RCData) (string, error) { return Render(rcScript, d) }
 
+// NginxDomain is one hostname in an app's vhost. CertLive gates HTTPS.
+type NginxDomain struct {
+	Hostname string
+	Primary  bool
+	CertLive bool
+}
+
 type NginxAppData struct {
-	Name       string
-	IP         string
-	Port       int
-	ServerName string
+	Name    string
+	IP      string
+	Port    int
+	Webroot string // ACME HTTP-01 challenge webroot, shared across apps
+
+	PrimaryHostname string
+	PrimaryCertLive bool
+	PrimaryLiveDir  string // certbot's live dir for the app's shared cert
+
+	Domains []NginxDomain
 }
 
 func NginxApp(d NginxAppData) (string, error) { return Render(nginxApp, d) }