Sanitize codebase, reorganize docs, and add missing deploy files

Remove dead code identified in docs/SANITIZATION-REVIEW.md:
- app/blueprints/content_old.py and app/blueprints/playlist.py
- app/models/group.py, app/utils/nginx_config_reader.py
- orphaned templates (content_list, edit_content, upload_content,
  player_page) and the related group/Template references

Result: 6 blueprints, 82 routes, no dead modules or orphan templates.

Add files that deploy.sh and docker-entrypoint.sh already require but
which were never tracked:
- https_manager.py       (referenced by deploy.sh, migrate_network.sh,
                          docker-entrypoint.sh)
- Caddyfile.example      (seeded by deploy.sh; its absence aborts deploy)

Relocate generated Graphify artifacts from graphify-out/ to
docs/graphify-out/ (110 files, no content change) and archive the
superseded docs under docs/.

Ignore hygiene:
- ignore ad-hoc .env backups (.env.bak*) — they contain live secrets
- keep the pre-sanitization snapshots (docs/legacy code/,
  docs/old_code_documentation/) on disk but out of the repo

Fix .env.example: drop a duplicated config block, genericize the
hardcoded host IP, and document HOSTNAME_INTERNAL.

docs/06-utils-services.md

@@ -9,7 +9,7 @@ All shared services live in `app/utils/`. This document details each module, its
 | Module | Community | Responsibility | Key symbols |
 |---|---|---|---|
 | `logger.py` | C0 | DB-backed audit logging | `log_action()`, `get_recent_logs()`, `clear_old_logs()` |
-| `group_player_management.py` | C0 | Group/player stats (legacy) | `get_player_status_info()`, `assign_player_to_group()`, `get_online_players_count()` |
+| `group_player_management.py` | C0 | Player status reporting | `get_player_status_info()` |
 | `caddy_manager.py` | C1 | HTTPS Caddyfile generation | `CaddyConfigGenerator`, `write_caddyfile()`, `reload_caddy()` |
 | `background_tasks.py` | C10 | Async task execution | `run_background_task()`, `background_player_deployment()` |
 | `ssh_deploy.py` | C10 | Remote player provisioning | `deploy_player_to_host()`, `test_ssh_connection()`, `generate_player_config()` |
@@ -18,7 +18,9 @@ All shared services live in `app/utils/`. This document details each module, its
 | `uploads.py` | C9 | Upload progress + file ops | `get/set/clear_upload_progress()`, `save_uploaded_file()`, `process_video_file()` |
 | `portal_sso.py` | C4 | SSO auto-login | `init_portal_sso()`, `_get_or_create_user()` |
 | `script_name_fix.py` | C4 | WSGI sub-path middleware | `ScriptNameFix` |
-| `nginx_config_reader.py` | C7 | Legacy nginx status parsing | `NginxConfigReader`, `get_nginx_status()` |
+
+> `nginx_config_reader.py` (C7) was **removed** during the sanitization pass — the
+> reverse proxy is Caddy. See [SANITIZATION-REVIEW.md](SANITIZATION-REVIEW.md).
 
 ---
 
@@ -81,11 +83,31 @@ Other helpers:
 
 | Method | Purpose |
 |---|---|
-| `generate_caddyfile(config)` | Pick template by mode: **HTTP-only** (`:80`), **domain** (Let's Encrypt), or **IP** (internal CA self-signed). Includes `reverse_proxy digiserver-app:5000`, 2 GB body limit, gzip, security headers |
+| `generate_caddyfile(config, http_fallback=True)` | Pick template by mode: **HTTP-only** (`:80`), **domain** (Let's Encrypt), or **IP-only** (internal CA `tls internal`). Includes `reverse_proxy digiserver-app:5000`, 2 GB body limit, gzip, security headers. `http_fallback` also serves plain HTTP alongside internal-CA TLS so clients that cannot trust the local CA still work |
 | `write_caddyfile(content, path=/etc/caddy/Caddyfile)` | Write to disk |
 | `reload_caddy()` | POST to Caddy admin API `http://caddy:2019/load` |
 
-Triggered from `admin.update_https_config` after saving `HTTPSConfig`.
+Triggered from `admin.update_https_config` (Admin UI) **or** `https_manager.py` (CLI),
+both of which save `HTTPSConfig` first so the two paths stay in sync.
+
+> **Internal CA vs Let's Encrypt:** an intranet name (e.g. `*.harting.intra`) is not
+> resolvable publicly, so ACME challenges cannot succeed. Leaving `domain` empty selects
+> `tls internal`, which needs no DNS and no external service. See
+> [07 · Deployment §6](07-deployment.md#6-https-setup-caddy).
+
+---
+
+## 4b. `https_manager.py` — HTTPS CLI (repo root)
+
+Command-line equivalent of the Admin HTTPS page, used by `deploy.sh`.
+
+| Command | Purpose |
+|---|---|
+| `enable <hostname> <domain> <email> <ip> [port]` | Persist `HTTPSConfig`, regenerate + write the Caddyfile, hot-reload Caddy. Empty `<domain>` → internal CA. `--redirect-only` to disable the HTTP fallback; `--no-https` for HTTP only |
+| `disable` | Turn HTTPS off (HTTP only) |
+| `status` | Print the stored configuration and resolved mode |
+
+Exit codes: `0` success · `1` bad args/config · `2` config applied but Caddy did not reload.
 
 ---
 
@@ -131,9 +153,16 @@ Used by the upload pipeline: **PPTX → PDF → PNG slides (Full HD)**.
 
 ---
 
-## 9. `nginx_config_reader.py` — Legacy (informational)
+## 9. `group_player_management.py` — Player Status
 
-`NginxConfigReader` parses an `nginx.conf` and reports `ssl_enabled`, ports, upstreams, `server_names`, `ssl_protocols`, `client_max_body_size`, `gzip`. **Legacy** — the current reverse proxy is Caddy; retained for reference and the old deployment stack.
+Only `get_player_status_info(player_id)` remains: it returns the online flag
+(5-minute window), status, last-seen plus a humanised "time ago", and the latest
+`PlayerFeedback`. Used by `players.list` and `players.manage_player`.
+
+The group helpers (`get_group_statistics`, `assign_player_to_group`,
+`bulk_assign_players_to_group`) and the status-list helpers
+(`get_online_players_count`, `get_players_by_status`) were **removed** with the
+archived Group subsystem.
 
 ---