Prepare wizwar.kestrelsnest.social: Caddy vhost and DNS notes

Caddy on the droplet now answers for both the sslip.io hostname and
wizwar.kestrelsnest.social, fetching the latter's certificate
automatically the moment DNS resolves. The domain's authoritative
nameservers are Hover's, so the required A record must be added there;
a matching record was also placed in the (currently inert)
DigitalOcean zone for future-proofing. README updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/README.md

@@ -8,9 +8,11 @@ survive deploys and reboots.
 ## Current production
 
 - Droplet: `wizwar` (nyc3, s-1vcpu-1gb, tag `wizwar`), IP 104.236.96.198
-- URL: https://wizwar.104.236.96.198.sslip.io
-  (sslip.io resolves the embedded IP — zero DNS setup. To use a real domain,
-  point an A record at the droplet and update /etc/caddy/Caddyfile.)
+- URLs: https://wizwar.kestrelsnest.social (once the Hover A record lands)
+  and https://wizwar.104.236.96.198.sslip.io (always works, zero DNS).
+  Caddy serves both; NOTE: kestrelsnest.social's authoritative DNS is at
+  HOVER (ns1/ns2.hover.com), not DigitalOcean — records must be added there.
+  A matching record also sits in the DO zone in case nameservers ever move.
 
 ## Everyday deploys