Use certbot --deploy-hook to reload nginx only on certificate renewal

[Copilot]

What problem does this PR solve?

Addresses feedback from #1682 (discussion): nginx was being reloaded every 12 hours regardless of whether certificates were actually renewed, causing unnecessary reloads.

How did you fix the problem?

Use certbot's --deploy-hook option which only executes when a certificate is successfully renewed:

certbot renew --deploy-hook "
  NGINX_ID=\$(docker ps -q -f 'name=nginx' | head -1)
  if [ -n \"\$NGINX_ID\" ]; then
    docker exec \"\$NGINX_ID\" nginx -s reload
  fi
"

• Nginx reload now only triggers on actual certificate renewal
• Eliminates ~730 unnecessary nginx reloads per year (2 per day × 365)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.