feat: add nginx reverse proxy

docs/operations.md

@@ -5,13 +5,19 @@
 ```bash
 docker compose up --build -d
 docker compose ps
-docker compose logs -f backend frontend postgres
+docker compose logs -f nginx backend frontend postgres
 docker compose down
 ```
 
-Compose health checks PostgreSQL and Django. The public health endpoint is
-`http://localhost:8000/health/`; the aggregate content endpoint is
-`http://localhost:8000/api/site/home/`.
+Compose health checks all services. Through the virtual host, the public health endpoint
+is `http://azionelab.org:8080/health/`; the aggregate content endpoint is
+`http://azionelab.org:8080/api/site/home/`.
+
+Test routing without changing the hosts file:
+
+```bash
+curl --resolve azionelab.org:8080:127.0.0.1 http://azionelab.org:8080/health/
+```
 
 Apply schema changes with `docker compose exec backend python manage.py migrate`.
 Create editors with `createsuperuser`; use Wagtail permissions for later non-superuser
@@ -42,3 +48,4 @@ Keep real backups encrypted and off-host with a defined retention policy.
 - Frontend fallback content can mask a CMS outage, so monitor backend health directly.
 - Local named volumes are not off-host backups.
 - Development media serving is unsuitable for production traffic.
+- The local reverse proxy provides HTTP only; it does not manage certificates.