Add prod nginx image with clearnet, onion, and SPA build.

Multi-stage frontend embed, envsubst entrypoint for TLS vhosts and upload body limits, shared locations with minimal response headers and zero access logs.

nginx/docker-entrypoint.sh

@@ -0,0 +1,47 @@
+#!/bin/sh
+set -eu
+
+max_image_bytes="${VALIDATION_UPLOAD_MAX_IMAGE_BYTES:?}"
+json_padding="${VALIDATION_UPLOAD_JSON_BODY_PADDING_BYTES:?}"
+
+UPLOAD_MAX_REQUEST_BODY_BYTES=$(( (max_image_bytes * 4 + 2) / 3 + json_padding ))
+
+export UPLOAD_MAX_REQUEST_BODY_BYTES BACKEND_PORT
+
+render_locations() {
+    envsubst '${BACKEND_PORT} ${UPLOAD_MAX_REQUEST_BODY_BYTES}' \
+        < /etc/nginx/templates/snippets/private-image-locations.conf.template \
+        > /etc/nginx/snippets/private-image-locations.conf
+}
+
+render_server() {
+    template_path="$1"
+    output_path="$2"
+    surface="$3"
+
+    if [ "$surface" = "clearnet" ]; then
+        if [ -n "${ONION_HOSTNAME:-}" ]; then
+            export ONION_LOCATION_HEADER="add_header Onion-Location \"http://${ONION_HOSTNAME}\$request_uri\";"
+        else
+            export ONION_LOCATION_HEADER=""
+        fi
+
+        export CLEARNET_DOMAIN
+        
+        envsubst '${CLEARNET_DOMAIN} ${ONION_LOCATION_HEADER}' \
+            < "$template_path" \
+            > "$output_path"
+
+        return
+    fi
+
+    cp "$template_path" "$output_path"
+}
+
+mkdir -p /etc/nginx/snippets
+
+render_locations
+render_server /etc/nginx/templates/conf.d/clearnet.conf.template /etc/nginx/conf.d/clearnet.conf clearnet
+render_server /etc/nginx/templates/conf.d/onion.conf.template /etc/nginx/conf.d/onion.conf onion
+
+exec nginx -g 'daemon off;'