docs: add README and per-file header comments

- Rewrote README with full directory structure, add/remove site
  workflows, deploy instructions, and a test suite reference table
- Added a one-line header comment to each sites-available/*.conf
  explaining what category of sites belongs in that file

nginx/nginx/sites-available/afp.conf

@@ -1,3 +1,4 @@
+# AFP service proxy.
 server {
   listen 443 ssl;
   server_name afp.nhcarrigan.com;

nginx/nginx/sites-available/aria.conf

@@ -1,3 +1,4 @@
+# Aria bot, Cordelia AI assistant, trans-related services, and legacy redirects.
 server {
   listen 443 ssl;
   server_name aria.nhcarrigan.com;

nginx/nginx/sites-available/bots.conf

@@ -1,3 +1,4 @@
+# Discord bots and automated services (one entry per bot, sorted alphabetically).
 server {
   listen 443 ssl;
   server_name altaria.nhcarrigan.com;

nginx/nginx/sites-available/cdn.conf

@@ -1,3 +1,4 @@
+# CDN reverse proxy to Hetzner object storage, with legacy path redirects and CORS headers.
 server {
     listen 443 ssl;
     listen [::]:443 ssl;

nginx/nginx/sites-available/celestine.conf

@@ -1,3 +1,4 @@
+# Celestine webhook handler and legacy hooks redirect.
 server {
   listen 443 ssl;
   server_name celestine.nhcarrigan.com;

nginx/nginx/sites-available/content.conf

@@ -1,3 +1,4 @@
+# Static content and publishing sites: blog, books, donate, music, secrets, style, testimonials.
 server {
   listen 443 ssl;
   server_name blog.nhcarrigan.com;

nginx/nginx/sites-available/data.conf

@@ -1,3 +1,4 @@
+# Data service proxy.
 server {
   listen 443 ssl;
   server_name data.nhcarrigan.com;

nginx/nginx/sites-available/docs.conf

@@ -1,3 +1,4 @@
+# Documentation and informational sites: contact, docs, manual, sitemap, socials.
 server {
   listen 443 ssl;
   server_name contact.nhcarrigan.com;

nginx/nginx/sites-available/eclaire.conf

@@ -1,3 +1,4 @@
+# Eclaire Angular SPA.
 server {
   listen 443 ssl;
   server_name eclaire.nhcarrigan.com;

nginx/nginx/sites-available/elowyn.conf

@@ -1,3 +1,4 @@
+# Elowyn Angular SPA.
 server {
   listen 443 ssl;
   server_name elowyn.nhcarrigan.com;

nginx/nginx/sites-available/forms.conf

@@ -1,3 +1,4 @@
+# Grist forms platform (forms-api backend + forms frontend with CSS injection) and legacy form URL redirects.
 server {
   listen 443 ssl;
   server_name forms-api.nhcarrigan.com;

nginx/nginx/sites-available/games.conf

@@ -1,3 +1,4 @@
+# Games and gaming projects: beccalia, games hub, goblin, loan, lore, silly, wompwomp, yurigpt.
 server {
   listen 443 ssl;
   server_name beccalia.nhcarrigan.com;

nginx/nginx/sites-available/git.conf

@@ -1,3 +1,4 @@
+# Self-hosted Gitea instance.
 server {
   listen 443 ssl;
   server_name git.nhcarrigan.com;

nginx/nginx/sites-available/hikari.conf

@@ -1,3 +1,4 @@
+# Hikari desktop app (Angular SPA + API backend) and legacy redirect subdomains.
 server {
   listen 443 ssl;
   server_name announcements.nhcarrigan.com;

nginx/nginx/sites-available/library.conf

@@ -1,3 +1,4 @@
+# Library service proxy.
 server {
   listen 443 ssl;
   server_name library.nhcarrigan.com;

nginx/nginx/sites-available/lucinda.conf

@@ -1,3 +1,4 @@
+# Lucinda full-stack app (Angular SPA + API backend).
 server {
   listen 443 ssl;
   server_name lucinda.nhcarrigan.com;

nginx/nginx/sites-available/lynira.conf

@@ -1,3 +1,4 @@
+# Lynira.link domain (bare + www).
 server {
   listen 443 ssl;
   server_name lynira.link;

nginx/nginx/sites-available/mommy.conf

@@ -1,3 +1,4 @@
+# Mommy bot suite: mommy-bot Discord bot, mommy-slack Slack bot, mommy web front-end.
 server {
   listen 443 ssl;
   server_name mommy-bot.nhcarrigan.com;

nginx/nginx/sites-available/monitoring.conf

@@ -1,3 +1,4 @@
+# Monitoring stack: analytics, incidents, logs, telemetry, uptime.
 server {
   listen 443 ssl;
   server_name analytics.nhcarrigan.com;

nginx/nginx/sites-available/nails.conf

@@ -1,3 +1,4 @@
+# Nails app: Angular front-end SPA and API backend.
 server {
   listen 443 ssl;
   server_name nails-api.nhcarrigan.com;

nginx/nginx/sites-available/notes.conf

@@ -1,3 +1,4 @@
+# SilverBullet notes instance and Planka project board.
 server {
   listen 443 ssl;
   server_name board.nhcarrigan.com;

nginx/nginx/sites-available/portfolio.conf

@@ -1,3 +1,5 @@
+# Personal portfolio and vanity domains (naomi.lgbt, naomi.party, nhcarrigan.com, nhcarrigan.link, resume)
+# plus a wildcard catch-all that redirects *.naomi.lgbt → *.nhcarrigan.com.
 server {
   listen 443 ssl;
   server_name naomi.lgbt;

nginx/nginx/sites-available/rosalia.conf

@@ -1,3 +1,4 @@
+# Rosalia alerting service and legacy alerts redirect.
 server {
   listen 443 ssl;
   server_name alerts.nhcarrigan.com;

nginx/nginx/sites-available/scheduling.conf

@@ -1,3 +1,4 @@
+# Scheduling shortcuts that redirect to zcal.co (cyc, meet) and tasks redirect.
 server {
   listen 443 ssl;
   server_name cyc.nhcarrigan.com;

nginx/nginx/sites-available/security.conf

@@ -1,3 +1,4 @@
+# Security tooling: SonarQube code quality gate and DefectDojo vulnerability management.
 server {
   listen 443 ssl;
   server_name quality.nhcarrigan.com;

nginx/nginx/sites-available/support.conf

@@ -1,3 +1,4 @@
+# Discourse community support forum and legacy chat/forum redirects.
 server {
   listen 443 ssl;
   server_name chat.nhcarrigan.com;

nginx/nginx/sites-available/vitalia.conf

@@ -1,3 +1,4 @@
+# Vitalia app: Angular front-end SPA and API backend.
 server {
   listen 443 ssl;
   server_name vitalia-api.nhcarrigan.com;

nginx/nginx/sites-available/wtf.conf

@@ -1,3 +1,4 @@
+# wtf.naomi.lgbt personal project.
 server {
   listen 443 ssl;
   server_name wtf.naomi.lgbt;