Namecheap API setup for wildcard cert

Do this once on your phone browser (no terminal):

1. Log into https://namecheap.com
2. Click your username (top right) → "Account"
3. Left sidebar → "Profile" → "Tools"
4. Find "API Access" section
5. Toggle it ON (it'll show "ON" with a key below)
6. Find "IP Address Whitelist" section
7. Add this IP to the whitelist (one entry):

   185.249.73.178

8. Copy the API key that appears (long string starting with a hex blob)
9. Open chat with Mavis and paste the API key inside a copy box:

   ```
   <paste your Namecheap API key here>
   ```

That's it. Mavis will:
- Install acme.sh on the VPS
- Issue wildcard certs for *.preview.freshvibeapps.com AND *.freshvibeapps.com
- Update nginx to use the new wildcard certs
- Set up auto-renew cron (checks weekly, renews when 30 days from expiry)
- Move the old cert out of the way but keep it as a 30-day fallback (LE best practice)
- Tell you when it's done

After that, every preview project (and every client subdomain) gets a valid HTTPS cert automatically, forever. No more "your connection is not private" errors.

If anything in the Namecheap UI is different from these steps, send Mavis a screenshot and they'll figure it out.