deploy: reload nginx after a certificate renewal

`certbot certonly` replaces the files on disk but signals nothing, so nginx
would have gone on serving the old certificate until some unrelated reload
happened — which is to say the cert would have quietly expired in January.
`--nginx` installs this hook itself; keeping the vhost in git means we
install it ourselves.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/deploy.sh

@@ -115,6 +115,19 @@ EOF
         --keep-until-expiring
 fi
 
+# `certonly` renews the files but tells nothing to pick them up, so without a
+# deploy hook nginx keeps serving the old certificate until something reloads it
+# by chance — i.e. it silently expires. `--nginx` would have done this for us;
+# this is the price of keeping the vhost in git.
+say "Installing the renewal hook"
+install -d /etc/letsencrypt/renewal-hooks/deploy
+cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'HOOK'
+#!/bin/sh
+# Installed by kadence's deploy/deploy.sh. Runs after any successful renewal.
+nginx -t && systemctl reload nginx
+HOOK
+chmod 755 /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
+
 say "Installing the vhost"
 install -m 644 "$VHOST_SRC" "$VHOST_DST"
 ln -sfn "$VHOST_DST" "/etc/nginx/sites-enabled/${DOMAIN}"