feat: ummah2.falahos.my WordPress stack on Contabo + falah-shortcodes plugin

- docker-compose.yml: MariaDB 11 + WordPress 6.7 PHP8.3-FPM + Nginx
- nginx/default.conf: FastCGI pass, security headers, cache headers
- deploy.sh: one-command spin-up with WP-CLI install + plugin activation
- migrate-from-cpanel.sh: import cPanel backup (SQL/tar.gz/zip) with URL rewrite
- wordpress-plugins/falah-shortcodes: prayer times, dhikr, qibla, daily verse, nur/wallet/souq iframes
- wordpress-plugins/hermes-ai-bridge: REST API bridge with plugin install/activate endpoints

Migration path: cPanel → Contabo Docker (Imunify360 bypass)

ummah-wordpress/deploy.sh

@@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+# deploy.sh — spin up ummah2.falahos.my WordPress on Contabo
+# Run on Contabo: bash deploy.sh
+set -euo pipefail
+
+DEPLOY_DIR="/opt/ummah-wordpress"
+SITE_URL="https://ummah2.falahos.my"
+WP_PLUGINS_DIR="$DEPLOY_DIR/wp-data/wp-content/plugins"
+
+echo "▶ Deploying ummah2.falahos.my WordPress on Contabo"
+
+# ── Prerequisites ────────────────────────────────────────────────────────────
+command -v docker >/dev/null || { echo "❌ docker not found"; exit 1; }
+docker compose version >/dev/null 2>&1 || { echo "❌ docker compose plugin not found"; exit 1; }
+
+# ── Setup deploy dir ─────────────────────────────────────────────────────────
+mkdir -p "$DEPLOY_DIR"
+cd "$DEPLOY_DIR"
+
+if [ ! -f .env ]; then
+  cp .env.example .env
+  echo ""
+  echo "⚠️  Fill in .env before continuing:"
+  echo "    DB_ROOT_PASSWORD, DB_PASSWORD, WP_ADMIN_PASSWORD"
+  echo "    nano $DEPLOY_DIR/.env"
+  exit 0
+fi
+
+source .env
+
+# ── Start stack ───────────────────────────────────────────────────────────────
+echo "── Starting MariaDB + WordPress + Nginx ──"
+docker compose up -d db
+echo "   Waiting for DB to be ready…"
+sleep 10
+docker compose up -d
+
+# ── Wait for WordPress to be ready ───────────────────────────────────────────
+echo "── Waiting for WordPress container ──"
+for i in $(seq 1 30); do
+  if docker compose exec -T wordpress test -f /var/www/html/wp-includes/version.php 2>/dev/null; then
+    echo "   WordPress files ready."
+    break
+  fi
+  sleep 3
+done
+
+# ── Install WordPress via WP-CLI ──────────────────────────────────────────────
+echo "── Installing WordPress ──"
+docker compose run --rm wpcli core install \
+  --url="$SITE_URL" \
+  --title="$WP_SITE_TITLE" \
+  --admin_user="$WP_ADMIN_USER" \
+  --admin_password="$WP_ADMIN_PASSWORD" \
+  --admin_email="$WP_ADMIN_EMAIL" \
+  --skip-email 2>/dev/null || echo "   (already installed)"
+
+# ── Install plugins ───────────────────────────────────────────────────────────
+echo "── Installing plugins ──"
+
+# Hermes AI Bridge (from Gitea raw)
+docker compose run --rm wpcli plugin install \
+  "https://git.falahos.my/wmj/hermes-cpanel-agent/archive/main.zip" \
+  --activate 2>/dev/null || echo "   hermes-ai-bridge: manual install needed"
+
+# Falah Shortcodes (from Gitea raw via falahos org)
+docker compose run --rm wpcli plugin install \
+  "https://git.falahos.my/falahos/falah-os-ce/raw/branch/community-edition/wordpress-plugins/falah-shortcodes.zip" \
+  --activate 2>/dev/null || echo "   falah-shortcodes: manual install needed"
+
+# Essential plugins from WP.org
+for plugin in astra-sites tutor learndash-gutenberg-blocks mailpoet woocommerce easy-digital-downloads redis-cache; do
+  docker compose run --rm wpcli plugin install "$plugin" --activate 2>/dev/null || true
+done
+
+# ── Set permalink structure ───────────────────────────────────────────────────
+docker compose run --rm wpcli rewrite structure '/%postname%/' --hard
+
+# ── Configure Caddy ───────────────────────────────────────────────────────────
+echo "── Configuring Caddy reverse proxy ──"
+CADDY_FILE="/etc/caddy/conf.d/ummah2.conf"
+mkdir -p /etc/caddy/conf.d
+
+cat > "$CADDY_FILE" << 'CADDY'
+ummah2.falahos.my {
+    reverse_proxy localhost:8888
+
+    encode gzip
+
+    header {
+        Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
+        X-Frame-Options SAMEORIGIN
+        X-Content-Type-Options nosniff
+        Referrer-Policy strict-origin-when-cross-origin
+        -Server
+    }
+}
+CADDY
+
+# Reload Caddy if running
+if systemctl is-active --quiet caddy 2>/dev/null; then
+  systemctl reload caddy
+  echo "   Caddy reloaded ✅"
+elif docker ps --format '{{.Names}}' | grep -q caddy; then
+  docker kill --signal=USR1 "$(docker ps --format '{{.Names}}' | grep caddy)"
+  echo "   Caddy (docker) reloaded ✅"
+else
+  echo "   ⚠️  Caddy not found — add ummah2.falahos.my block to your reverse proxy manually"
+  echo "   Nginx port 8888 → ummah2.falahos.my"
+fi
+
+echo ""
+echo "✅ ummah2.falahos.my is up on port 8888"
+echo "   WP Admin: $SITE_URL/wp-admin  (user: $WP_ADMIN_USER)"
+echo ""
+echo "── Next: point DNS ──"
+echo "   ummah2.falahos.my A → 13.140.161.244"