feat(deploy): configurable nginx upstreams via env vars (#183)

[amavashev]

Closes #183.

Problem

The dashboard image bundles an nginx reverse proxy that splits /v1/* traffic between the governance plane (/v1/*) and the runtime plane (/v1/reservations/*). The two upstream targets were hardcoded in nginx.conf, so retargeting them (split hosts, external endpoints, non-default ports) meant editing the config and rebuilding the image.

Change

Ship the proxy config as an envsubst template (nginx.conf → default.conf.template) with ${ADMIN_UPSTREAM} / ${RUNTIME_UPSTREAM} placeholders, rendered by the stock nginx entrypoint (20-envsubst-on-templates.sh) at container start. Defaults (http://cycles-admin:7979 / http://cycles-server:7878) are baked into the image and match the compose service names, so existing deployments are unaffected. Override either var at deploy time — no file edit, no image rebuild:

dashboard:
  environment:
    ADMIN_UPSTREAM: https://admin.internal:7979
    RUNTIME_UPSTREAM: https://runtime.internal:7878

Why not the VITE_* approach from the issue

VITE_ADMIN_URL / VITE_RUNTIME_URL driving direct cross-origin fetch was declined (see AUDIT.md): VITE_* bakes at build time (one image per env, defeating the portable-artifact model), requires relaxing CSP connect-src 'self', turns on mandatory CORS + preflight for X-Admin-API-Key on both backends, and sends the admin key cross-origin. Keeping the same-origin bundled proxy avoids all four.

Files

• nginx.conf → default.conf.template — upstreams now placeholders
• Dockerfile — copy template to /etc/nginx/templates/; bake ENV defaults
• docker-compose.prod.yml — document the two vars on the dashboard service
• CI: e2e.yml + pr-container-scan.yml path filters nginx.conf → default.conf.template
• Docs: README, OPERATIONS, AUDIT (+ baseline cycles-server .15 → .17 fix), CHANGELOG, package.json 0.1.25.60 → 0.1.25.61

Validation

• Ran the real nginx:1.29-alpine3.23 entrypoint with override upstreams; the entrypoint launched 20-envsubst-on-templates.sh and nginx -t reported syntax OK / test successful on the rendered config.
• Replicated the entrypoint's envsubst step locally: both upstreams fill, all nginx runtime vars ($host / $request_uri / $upstream / …) are preserved, zero leftover ${…} placeholders.
• No src/ change, so the Vitest suite is unaffected.

Deployment-infra only — no spec change, no admin-API surface delta, no client behaviour change.