[Deploy] nginx reverse proxy — TLS 1.3 configuration

[maxzaikin]

Summary

Configure nginx as TLS-terminating reverse proxy for
Portal and API with security headers.

Context

See Operations-Network-Setup and
Architecture-Network-Topology

Acceptance Criteria

• deploy/nginx/vaultflower.conf created
• TLS 1.3 only (no TLS 1.2)
• Strong cipher suites: TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256
• /api/* → proxy to vfw-dc-api:7001
• / → proxy to vfw-dc-portal:7002
• WebSocket upgrade headers for Blazor Server SignalR
• proxy_read_timeout 3600s (for long-running SignalR connections)
• Security headers: HSTS, X-Frame-Options, X-Content-Type-Options
• Cache-Control: no-store for /api//checkouts//password
• HTTP → HTTPS redirect (port 80 → 443)
• /health → proxy to API (no auth, for Consul)
• Verified: curl -k https://vfw-core.contoso.com/health/ready returns 200