deploy: default to ACME-issued certs, drop manual cert setup

Domain deployment now uses ACME_HOST (acme-companion auto issue/renew)
instead of the legacy LETSENCRYPT_HOST name. IP-only deployments can use
acme.sh to obtain Let's Encrypt IP certificates (shortlived profile,
~7-day validity, http-01 only) instead of self-signed manual certs:
documented the acme-ip service, first-issue command with install-cert
into nginx-certs and nginx reload via docker socket.

Removed the manual WEBHOOK_CERT flow and the ./cert volume from the
compose example.

docker-compose.yml.example

@@ -49,14 +49,16 @@ services:
       # Link-result cache TTL (default 604800 = 7 days).
       LINK_CACHE_TTL_SECONDS: '604800'
       RUST_LOG: 'info'
-      VIRTUAL_HOST: 'bot.example.com'
+      # 域名部署：替换为你的域名；纯 IP 部署：替换为服务器公网 IP（需按
+      # README「只有 IP」一节签发 acme IP 证书）。
+      VIRTUAL_HOST: '<YOUR_DOMAIN>'
       VIRTUAL_PORT: '8443'
-      # LETSENCRYPT_HOST: 'bot.example.com'
+      # 域名部署：取消注释并设为域名，由 acme-companion 自动签发/续期证书。
+      # ACME_HOST: 'your.domain.com'
       WEBHOOK: 'true'
       WEBHOOK_LISTEN: '0.0.0.0'
       WEBHOOK_PORT: '8443'
-      WEBHOOK_URL: 'https://bot.example.com/'
-      # WEBHOOK_CERT: './cert/cert.pem'
+      WEBHOOK_URL: 'https://<YOUR_DOMAIN>/'
       WEBHOOK_SECRET_TOKEN: ''
     volumes:
       - ./data:/app/data