Repair Nginx reverse-proxy and update security/timeouts

[AlexKitipov]

Motivation

• Align Nginx config with the actual service layout so the proxy forwards traffic correctly and the frontend is served as a static build.
• Replace obsolete and unsafe response headers with modern security headers and reasonable API limits for this app.

Description

• Updated nginx/gateway-hub.conf to remove the stale frontend upstream and treat the frontend as a static build served from /usr/share/nginx/html.
• Fixed short-link redirect routing so requests under /r/ are proxied to the backend without duplicating the /r prefix and added consistent forwarded headers for backend requests.
• Added API request limits and proxy timeouts (client_max_body_size, client_body_timeout, proxy_connect_timeout, proxy_send_timeout, proxy_read_timeout, send_timeout) and disabled request buffering for API routes.
• Replaced X-XSS-Protection with modern headers including Content-Security-Policy and Cross-Origin-Opener-Policy, added other recommended headers (Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), and standardized gzip/cache rules and static asset handling.

Testing

• Ran git diff --check to validate whitespace and trivial issues and it passed.
• Searched the config for deprecated patterns and stale upstreams with ripgrep and found none of the problematic patterns.
• Executed a Python-based lint that verifies semicolons and brace balance in nginx/gateway-hub.conf and it passed (basic nginx config structure OK).
• Attempted nginx -t but the nginx binary is not present in this environment so the runtime config test was skipped.

---

Codex Task