fix: unlock immutable files before destroy, timeout LE cert request

deploy.sh

@@ -44,6 +44,11 @@ go build -o "$BINARY_NAME" .
 if [ "$GREENFIELD" = true ]; then
     echo "[3/6] Removing old deployment..."
 
+    # Unlock immutable files (chattr +i from previous deploy) before removing
+    if [ -d "$TARGET_DIR" ]; then
+        chattr -R -i "$TARGET_DIR" 2>/dev/null || true
+    fi
+
     # Preserve .env across greenfield destroy
     if [ -f "$TARGET_DIR/.env" ]; then
         cp "$TARGET_DIR/.env" /tmp/nextworkspace.env.bak
@@ -303,9 +308,9 @@ EOF
             curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
                 -d "set=${TLS_EMAIL}" > /dev/null
 
-            # Obtain certificate
+            # Obtain certificate (30s timeout — can hang if DNS doesn't resolve)
             echo "  Requesting LE certificate for app.${DOMAIN}..."
-            CERT_RESULT=$(curl -s -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
+            CERT_RESULT=$(curl -s --max-time 30 -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
                 -G -d "domains=app.${DOMAIN}" -d "filename=app.${DOMAIN}" \
                 -d "email=${TLS_EMAIL}" -d "ca=Let's Encrypt" -d "dns=false" 2>&1)
             if echo "$CERT_RESULT" | grep -qi '"success"\|"ok"\|"installed'; then