docs(deploy): correct DNS guidance for Hetzner suppliers — no wildcard exists

The PR #12 runbook and compose pre-flight headers claimed a wildcard
*.vector.apexfusion.org record covers new supplier hosts. It does not:
each mp-suppliers-* host is an individual DNS-only A record to
91.98.147.172, and on-box Let's Encrypt HTTP-01 issuance requires the
record to be unproxied.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/mainnet/docker-compose.supplier-ds-flash-htz-chat.yml

@@ -15,7 +15,8 @@
 #
 # Pre-flight:
 #   1. DNS: mp-suppliers-ds-flash-htz-chat.vector.apexfusion.org → host
-#      (wildcard *.vector.apexfusion.org already in place via Cloudflare)
+#      (individual DNS-only A record → 91.98.147.172; NO wildcard exists —
+#       letsencrypt HTTP-01 issuance needs the unproxied direct record)
 #   2. supplier/.env.ds-flash-htz-chat written on host (chmod 600) with at minimum:
 #        SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH,
 #        SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1,

deploy/mainnet/docker-compose.supplier-ds-flash-htz.yml

@@ -10,7 +10,8 @@
 #
 # Pre-flight:
 #   1. DNS: mp-suppliers-ds-flash-htz.vector.apexfusion.org → host
-#      (wildcard *.vector.apexfusion.org already in place via Cloudflare)
+#      (individual DNS-only A record → 91.98.147.172; NO wildcard exists —
+#       letsencrypt HTTP-01 issuance needs the unproxied direct record)
 #   2. supplier/.env.ds-flash-htz written on host (chmod 600) with at minimum:
 #        SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH,
 #        SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1,

deploy/mainnet/docker-compose.supplier-glm-chat.yml

@@ -15,7 +15,8 @@
 #
 # Pre-flight:
 #   1. DNS: mp-suppliers-glm-chat.vector.apexfusion.org → host
-#      (wildcard *.vector.apexfusion.org already in place via Cloudflare)
+#      (individual DNS-only A record → 91.98.147.172; NO wildcard exists —
+#       letsencrypt HTTP-01 issuance needs the unproxied direct record)
 #   2. supplier/.env.glm-chat written on host (chmod 600) with at minimum:
 #        SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH,
 #        SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1,

deploy/mainnet/docker-compose.supplier-glm.yml

@@ -10,7 +10,8 @@
 #
 # Pre-flight:
 #   1. DNS: mp-suppliers-glm.vector.apexfusion.org → host
-#      (wildcard *.vector.apexfusion.org already in place via Cloudflare)
+#      (individual DNS-only A record → 91.98.147.172; NO wildcard exists —
+#       letsencrypt HTTP-01 issuance needs the unproxied direct record)
 #   2. supplier/.env.glm written on host (chmod 600) with at minimum:
 #        SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH,
 #        SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1,

deploy/mainnet/docker-compose.supplier-kimi-code-chat.yml

@@ -15,7 +15,8 @@
 #
 # Pre-flight:
 #   1. DNS: mp-suppliers-kimi-code-chat.vector.apexfusion.org → host
-#      (wildcard *.vector.apexfusion.org already in place via Cloudflare)
+#      (individual DNS-only A record → 91.98.147.172; NO wildcard exists —
+#       letsencrypt HTTP-01 issuance needs the unproxied direct record)
 #   2. supplier/.env.kimi-code-chat written on host (chmod 600) with at minimum:
 #        SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH,
 #        SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1,

deploy/mainnet/docker-compose.supplier-kimi-code.yml

@@ -10,7 +10,8 @@
 #
 # Pre-flight:
 #   1. DNS: mp-suppliers-kimi-code.vector.apexfusion.org → host
-#      (wildcard *.vector.apexfusion.org already in place via Cloudflare)
+#      (individual DNS-only A record → 91.98.147.172; NO wildcard exists —
+#       letsencrypt HTTP-01 issuance needs the unproxied direct record)
 #   2. supplier/.env.kimi-code written on host (chmod 600) with at minimum:
 #        SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH,
 #        SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1,

deploy/mainnet/docker-compose.supplier-qwen35b-chat.yml

@@ -15,7 +15,8 @@
 #
 # Pre-flight:
 #   1. DNS: mp-suppliers-qwen35b-chat.vector.apexfusion.org → host
-#      (wildcard *.vector.apexfusion.org already in place via Cloudflare)
+#      (individual DNS-only A record → 91.98.147.172; NO wildcard exists —
+#       letsencrypt HTTP-01 issuance needs the unproxied direct record)
 #   2. supplier/.env.qwen35b-chat written on host (chmod 600) with at minimum:
 #        SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH,
 #        SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1,

deploy/mainnet/docker-compose.supplier-qwen35b.yml

@@ -10,7 +10,8 @@
 #
 # Pre-flight:
 #   1. DNS: mp-suppliers-qwen35b.vector.apexfusion.org → host
-#      (wildcard *.vector.apexfusion.org already in place via Cloudflare)
+#      (individual DNS-only A record → 91.98.147.172; NO wildcard exists —
+#       letsencrypt HTTP-01 issuance needs the unproxied direct record)
 #   2. supplier/.env.qwen35b written on host (chmod 600) with at minimum:
 #        SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH,
 #        SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1,

docs/HETZNER_SETUP.md

@@ -48,8 +48,13 @@ fleet serving `deepseek/deepseek-v4-flash`.
    rate limits apply to the aggregate.
 2. Eight funded supplier wallets (50 AP3X each recommended; bonds are 1 AP3X
    per in-flight job and returned on completion).
-3. The usual mainnet supplier deploy prerequisites (`deploy/README.md`); the
-   wildcard DNS `*.vector.apexfusion.org` already covers the new hosts.
+3. The usual mainnet supplier deploy prerequisites (`deploy/README.md`).
+4. **DNS**: one A record per supplier — `mp-suppliers-<name>.vector.apexfusion.org`
+   → `91.98.147.172`, **DNS-only/unproxied**. There is NO wildcard for
+   `*.vector.apexfusion.org`; and because traefik issues certs on-box via
+   Let's Encrypt HTTP-01 (port 80), a proxied/CDN record would break issuance.
+   Certs are issued automatically within ~a minute of the record propagating —
+   no restarts needed.
 
 ## 3. Verify the backend before spending on-chain