feat(deploy): nginx vhost serves :443 with a self-signed origin cert

Lets Cloudflare run in Full mode (encrypted Cloudflare<->origin) instead
of Flexible (plaintext origin hop). Full (strict) is a later swap to a
Cloudflare Origin Certificate.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

DEPLOY.md

@@ -55,8 +55,10 @@ Verified house pattern — this deploy follows it exactly:
 | A    | `api` | `213.239.213.217`    | Proxied (🟠) |
 | A    | `www` | `213.239.213.217`    | Proxied (🟠) |
 
-**SSL/TLS mode:** **Full**. (The origin serves HTTP on :80, like the other apps
-on this box. Never use **Flexible**.)
+**SSL/TLS mode:** **Full**. The origin nginx vhost listens on :443 with a
+self-signed cert (step 5), so Cloudflare↔origin is encrypted. Never use
+**Flexible**. For **Full (strict)**, replace the self-signed cert with a
+Cloudflare Origin Certificate.
 
 ---
 
@@ -118,11 +120,18 @@ Health check: `curl http://127.0.0.1:4000/health` → `{"ok":true,...}`.
 
 ---
 
-## 5. nginx vhost **[server]**
+## 5. nginx vhost + origin cert **[server]**
 
-`infra/nginx/buildmymcpserver.conf` is ready. Install it on the host nginx:
+The vhost serves :80 and :443; the :443 listener needs an origin certificate.
+A self-signed cert is enough for Cloudflare **Full** mode:
 
 ```bash
+mkdir -p /etc/ssl/buildmymcpserver
+openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
+  -keyout /etc/ssl/buildmymcpserver/origin.key \
+  -out    /etc/ssl/buildmymcpserver/origin.crt \
+  -subj "/CN=buildmymcpserver.com"
+
 cp /opt/buildmymcpserver/infra/nginx/buildmymcpserver.conf \
    /etc/nginx/sites-available/buildmymcpserver
 ln -sf /etc/nginx/sites-available/buildmymcpserver \
@@ -131,8 +140,7 @@ nginx -t && systemctl reload nginx
 ```
 
 `nginx -t` must pass before the reload — a reload of a bad config is rejected,
-so the other live sites are never at risk. The vhost is `listen 80` only;
-Cloudflare provides TLS.
+so the other live sites are never at risk.
 
 ---