Websites deploy / provision agent (runs on websites VM: /opt/websites-agent)
Endpoints (X-Deploy-Token):
POST /deploy { slug } — git pull + build + pm2 restart
POST /provision { slug, host, gitRepoUrl } — clone + nginx + ecosystem + allowlist (no certbot)
POST /ssl { host, slug? } — certbot for apex + www (nginx must exist)
GET /health
Env (.env): PORT, DEPLOY_TOKEN, ALLOWED_SLUGS
Note: provision.sh intentionally skips certbot. SSL is issued via POST /ssl so
Edit/Add Domain does not hang when www DNS is wrong.
