baryovm site add: provision a static site end to end

Standing up a new static site on the VM is currently a sequence of hand-run steps: write an nginx server block, create the webroot, get a certificate, then rsync a build into place. Every site on this host went through it, and every time it is the same steps in the same order with a different name. That is exactly the shape BaryoVM already handles for container stacks. ## Proposed ``` baryovm site add barakocms.baryo.dev --root /var/www/barakocms-site baryovm site deploy barakocms.baryo.dev ./out ``` `add` would: - Create the webroot and the ACME challenge directory - Write an nginx server block from a template — HTTP redirect, TLS, `try_files` for a static export, long cache on hashed assets and none on HTML - Obtain a certificate via certbot **webroot**, which is what this host already uses (`authenticator = webroot`, `webroot_path = /var/www/letsencrypt`) - `nginx -t` before reloading, and roll back the config if the test fails — the same instinct as the health-gated `stack update` - Run `restorecon` afterwards, since SELinux on this host silently breaks a fresh webroot otherwise `deploy` would rsync a directory and reload, which is what every one of these sites does by hand today. ## Deliberately not doing DNS The A record still has to exist first, and that is a cloud API rather than something reachable over SSH. Mixing a provider API into an agentless SSH tool is a real scope decision, not an obvious win — a token with DNS edit rights is a much more dangerous credential than SSH access to one box. If it is wanted later, the honest shape is an optional, clearly separated integration — `baryovm dns` — that can be ignored entirely. Worth its own issue and its own argument. ## Why it is worth doing Four sites on this host follow this pattern and a fifth is waiting on it. The steps are known, the failure modes are known (a bad nginx config takes every site on the box down, not just the new one), and encoding them is strictly safer than a runbook nobody rereads.