Add prod nginx image with clearnet, onion, and SPA build.

Multi-stage frontend embed, envsubst entrypoint for TLS vhosts and upload body limits, shared locations with minimal response headers and zero access logs.

nginx/conf.d/onion.conf.template

@@ -0,0 +1,8 @@
+server {
+    listen 8080;
+    server_name _;
+
+    access_log off;
+
+    include /etc/nginx/snippets/private-image-locations.conf;
+}