feat: add nginx reverse proxy

docs/runbook.md

@@ -3,7 +3,7 @@
 ## Site shows fallback content
 
 1. Check `docker compose ps` and the backend health status.
-2. Request `http://localhost:8000/api/site/home/` directly.
+2. Request `http://azionelab.org:8080/api/site/home/` through NGINX.
 3. Inspect `docker compose logs backend postgres`.
 4. Verify `PUBLIC_CMS_API_URL` resolves from the frontend container.
 5. Restart the frontend after recovery so its static page is rebuilt from CMS data.
@@ -29,6 +29,15 @@
 4. For the frontend, request port `4321`, then check the API separately because
    fallback content can mask a CMS outage.
 
+## NGINX returns 404 or 502
+
+1. Confirm the request host is exactly `azionelab.org`; unknown hosts intentionally
+   receive 404.
+2. Run `docker compose exec nginx nginx -t`.
+3. Check `docker compose ps` and verify both backend and frontend are healthy.
+4. Inspect `docker compose logs --tail=200 nginx backend frontend`.
+5. Verify local DNS or `/etc/hosts` maps `azionelab.org` to the proxy address.
+
 ## Rollback
 
 Revert the application commit and rebuild containers. Preserve database/media volumes.