Prepare wizwar.kestrelsnest.social: Caddy vhost and DNS notes

Caddy on the droplet now answers for both the sslip.io hostname and
wizwar.kestrelsnest.social, fetching the latter's certificate
automatically the moment DNS resolves. The domain's authoritative
nameservers are Hover's, so the required A record must be added there;
a matching record was also placed in the (currently inert)
DigitalOcean zone for future-proofing. README updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/README.md

@@ -8,9 +8,11 @@ survive deploys and reboots.
 ## Current production
 
 - Droplet: `wizwar` (nyc3, s-1vcpu-1gb, tag `wizwar`), IP 104.236.96.198
-- URL: https://wizwar.104.236.96.198.sslip.io
+- URLs: https://wizwar.kestrelsnest.social (once the Hover A record lands)
-  (sslip.io resolves the embedded IP — zero DNS setup. To use a real domain,
+  and https://wizwar.104.236.96.198.sslip.io (always works, zero DNS).
-  point an A record at the droplet and update /etc/caddy/Caddyfile.)
+  Caddy serves both; NOTE: kestrelsnest.social's authoritative DNS is at
+  HOVER (ns1/ns2.hover.com), not DigitalOcean — records must be added there.
+  A matching record also sits in the DO zone in case nameservers ever move.
 
 ## Everyday deploys