Add prod nginx image with clearnet, onion, and SPA build.

Multi-stage frontend embed, envsubst entrypoint for TLS vhosts and upload body limits, shared locations with minimal response headers and zero access logs.

nginx/Dockerfile.prod

@@ -0,0 +1,46 @@
+FROM node:22.23.4-alpine AS frontend-builder
+
+WORKDIR /frontend
+
+COPY frontend/package*.json .
+COPY frontend/patches ./patches
+
+RUN npm ci
+
+COPY frontend/ .
+
+ARG VITE_API_BASE_URL
+ARG VITE_CLEARNET_SCHEME
+ARG VITE_CLEARNET_DOMAIN
+ARG VITE_ONION_HOSTNAME
+ARG VITE_ALTCHA_ENABLED
+ARG VITE_ALTCHA_MAX_NUMBER
+ARG VITE_UPLOAD_MAX_QUEUE_SIZE
+ARG VITE_VALIDATION_UPLOAD_MAX_VIEWS_MAX
+ARG VITE_VALIDATION_UPLOAD_MAX_IMAGE_BYTES
+
+ENV VITE_API_BASE_URL=$VITE_API_BASE_URL \
+    VITE_CLEARNET_SCHEME=$VITE_CLEARNET_SCHEME \
+    VITE_CLEARNET_DOMAIN=$VITE_CLEARNET_DOMAIN \
+    VITE_ONION_HOSTNAME=$VITE_ONION_HOSTNAME \
+    VITE_ALTCHA_ENABLED=$VITE_ALTCHA_ENABLED \
+    VITE_ALTCHA_MAX_NUMBER=$VITE_ALTCHA_MAX_NUMBER \
+    VITE_UPLOAD_MAX_QUEUE_SIZE=$VITE_UPLOAD_MAX_QUEUE_SIZE \
+    VITE_VALIDATION_UPLOAD_MAX_VIEWS_MAX=$VITE_VALIDATION_UPLOAD_MAX_VIEWS_MAX \
+    VITE_VALIDATION_UPLOAD_MAX_IMAGE_BYTES=$VITE_VALIDATION_UPLOAD_MAX_IMAGE_BYTES
+
+RUN npm run build
+
+FROM nginx:1.29.4-alpine
+
+RUN apk add --no-cache gettext
+
+COPY --from=frontend-builder /frontend/dist /usr/share/nginx/html
+
+COPY nginx/conf.d/ /etc/nginx/templates/conf.d/
+COPY nginx/snippets/private-image-locations.conf.template /etc/nginx/templates/snippets/
+COPY nginx/docker-entrypoint.sh /docker-entrypoint.sh
+
+RUN chmod +x /docker-entrypoint.sh
+
+ENTRYPOINT ["/docker-entrypoint.sh"]