feat: bootstrap webspace deploy and status-beacon landing page

Add public/index.php, private config bootstrap, FTPS deploy script,
and complete todo/01 including Let's Encrypt, HTTPS redirect, and HSTS docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

config/bootstrap.php

@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Load configuration from private/.env (outside document root).
+ * Called from httpdocs/*.php via require on private/config/bootstrap.php.
+ */
+
+function bootstrap(): array
+{
+    static $config = null;
+
+    if ($config !== null) {
+        return $config;
+    }
+
+    $envFile = dirname(__DIR__) . '/.env';
+    $config = loadEnvFile($envFile);
+
+    return $config;
+}
+
+function env(string $key, ?string $default = null): ?string
+{
+    $value = bootstrap()[$key] ?? null;
+
+    return ($value === null || $value === '') ? $default : $value;
+}
+
+function loadEnvFile(string $path): array
+{
+    if (!is_readable($path)) {
+        return [];
+    }
+
+    $vars = [];
+
+    foreach (file($path, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) as $line) {
+        $line = trim($line);
+
+        if ($line === '' || str_starts_with($line, '#')) {
+            continue;
+        }
+
+        if (!str_contains($line, '=')) {
+            continue;
+        }
+
+        [$key, $value] = explode('=', $line, 2);
+        $vars[trim($key)] = trim($value);
+    }
+
+    return $vars;
+}
+
+function privateDataDir(): string
+{
+    return dirname(__DIR__) . '/data';
+}