Add prod nginx image with clearnet, onion, and SPA build.

Multi-stage frontend embed, envsubst entrypoint for TLS vhosts and upload body limits, shared locations with minimal response headers and zero access logs.

nginx/snippets/private-image-locations.conf.template

@@ -0,0 +1,48 @@
+location ^~ /i/ {
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Cross-Origin-Resource-Policy "cross-origin" always;
+    add_header Cache-Control "private, no-store" always;
+
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    proxy_pass http://backend:${BACKEND_PORT};
+}
+
+location /api {
+    client_max_body_size ${UPLOAD_MAX_REQUEST_BODY_BYTES};
+
+    add_header Cache-Control "no-store" always;
+    
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    proxy_read_timeout 600s;
+    proxy_send_timeout 600s;
+    
+    proxy_pass http://backend:${BACKEND_PORT};
+}
+
+location /pgadmin {
+    proxy_set_header X-Script-Name /pgadmin;
+    proxy_set_header Host $host;
+    proxy_set_header X-Scheme $scheme;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+    proxy_pass_header Set-Cookie;
+
+    proxy_pass http://pgadmin;
+
+    proxy_redirect off;
+}
+
+location / {
+    add_header Referrer-Policy "no-referrer" always;
+    add_header Cache-Control "no-store" always;
+
+    root /usr/share/nginx/html;
+
+    try_files $uri $uri/ /index.html;
+}