Sanitize codebase, reorganize docs, and add missing deploy files

Remove dead code identified in docs/SANITIZATION-REVIEW.md:
- app/blueprints/content_old.py and app/blueprints/playlist.py
- app/models/group.py, app/utils/nginx_config_reader.py
- orphaned templates (content_list, edit_content, upload_content,
  player_page) and the related group/Template references

Result: 6 blueprints, 82 routes, no dead modules or orphan templates.

Add files that deploy.sh and docker-entrypoint.sh already require but
which were never tracked:
- https_manager.py       (referenced by deploy.sh, migrate_network.sh,
                          docker-entrypoint.sh)
- Caddyfile.example      (seeded by deploy.sh; its absence aborts deploy)

Relocate generated Graphify artifacts from graphify-out/ to
docs/graphify-out/ (110 files, no content change) and archive the
superseded docs under docs/.

Ignore hygiene:
- ignore ad-hoc .env backups (.env.bak*) — they contain live secrets
- keep the pre-sanitization snapshots (docs/legacy code/,
  docs/old_code_documentation/) on disk but out of the repo

Fix .env.example: drop a duplicated config block, genericize the
hardcoded host IP, and document HOSTNAME_INTERNAL.

.env.example

@@ -2,6 +2,47 @@
 # Copy to .env and update with your production values
 # IMPORTANT: Never commit this file to git
 
+# Server Configuration
+# ---------------------------------------------------------------------------
+# Deploy-time TLS bootstrap. Copy this file to `.env` and set these two before
+# `docker compose up`. Both must be present for HTTPS to be configured at
+# startup; if either is missing the app stays on the plain-HTTP fallback and you
+# can enable HTTPS later from Admin → HTTPS Configuration (no restart needed).
+# ---------------------------------------------------------------------------
+
+# Hostname shown in the UI and used in the Caddy site block.
+HOSTNAME_INTERNAL=digiserver
+
+# The host's LAN IP as reachable by the players/browsers.
+# Replace 192.168.1.100 with THIS server's actual LAN IP. It is used for the
+# Caddy site blocks and the certificate, so a wrong value breaks HTTPS.
+# Find it with: ip -4 route get 1.1.1.1 | grep -oP 'src \K[\d.]+'
+HOST_IP=192.168.1.100
+
+# Public domain for Let's Encrypt. LEAVE EMPTY for an intranet/internal name
+# (e.g. "digiserver" or "signage.corp.local") — a non-public name cannot pass an
+# ACME challenge, so an empty DOMAIN selects Caddy's internal CA instead.
+DOMAIN=
+
+# Email for ACME/Let's Encrypt notifications (unused by the internal CA).
+SSL_EMAIL=admin@example.com
+
+# Published ports. Caddy listens on 80/443 inside the container; these control
+# which host ports they are mapped to. Port 80 is always answered — the site
+# responds whether clients use the IP or the hostname.
+HTTP_PORT=80
+HTTPS_PORT=443
+
+# "true"  → also serve plain HTTP alongside HTTPS. Required for players whose
+#           trust store lacks the internal CA (i.e. verify_ssl is not disabled).
+# "false" → serve TLS only and redirect HTTP to https://<host>:<HTTPS_PORT>.
+HTTPS_HTTP_FALLBACK=true
+
+# After configuring HTTPS, probe it and automatically fall back to plain HTTP if
+# it does not come up — so a bad certificate can never make the site unreachable.
+# Set "false" to trust the configuration without probing.
+HTTPS_VERIFY=true
+
 # Flask Configuration
 FLASK_ENV=production
 FLASK_APP=app.app:create_app
@@ -20,25 +61,11 @@ ADMIN_EMAIL=admin@your-domain.com
 # For SQLite: sqlite:////data/instance/dashboard.db
 # DATABASE_URL=
 
-# Server Configuration
-# Set BEFORE deployment if host will have static IP after restart
-# This IP/domain will be used for SSL certificates and nginx configuration
-DOMAIN=your-domain.com
-HOST_IP=192.168.0.121
-EMAIL=admin@your-domain.com
 PREFERRED_URL_SCHEME=https
 
-# SSL/HTTPS (configured in nginx.conf by default)
-SSL_CERT_PATH=/etc/nginx/ssl/cert.pem
-SSL_KEY_PATH=/etc/nginx/ssl/key.pem
-
 # Logging
 LOG_LEVEL=INFO
 
-# Security Headers (configured in nginx.conf)
-HSTS_MAX_AGE=31536000
-HSTS_INCLUDE_SUBDOMAINS=true
-
 # Features (optional)
 ENABLE_LIBREOFFICE=true
 MAX_UPLOAD_SIZE=500000000  # 500MB