nginx: listen on PORT, default 8080; server_tokens off (closes #26)

nginx.conf is now a template the nginx image renders into conf.d at
container start. bin/entrypoint.sh gives nginx PORT, 8080 when unset or
empty, and limits the rendering to PORT with NGINX_ENVSUBST_FILTER, so
$uri, $host and every other nginx variable pass through unchanged. A
PORT nginx cannot listen on stops the container non-zero.
server_tokens off drops the version from the Server header and error
pages. script/frontend-viewport-test renders the template the same way.
EXPOSE still documents 8080; the backend stays on 127.0.0.1:8081.

Model: opus-5-5

bin/entrypoint.sh

@@ -23,8 +23,13 @@ backend=$!
 
 # nginx starts through the nginx image's own entrypoint, which applies
 # the image's start-up configuration and then replaces itself with
-# nginx.
-/docker-entrypoint.sh nginx -g 'daemon off;' &
+# nginx. Part of that start-up configuration renders nginx.conf into
+# conf.d with nginx listening on PORT, the public port, 8080 unless
+# set. NGINX_ENVSUBST_FILTER limits that rendering to PORT: a variable
+# nginx itself uses, such as $uri, would otherwise be replaced by an
+# environment variable of the same name.
+PORT="${PORT:-8080}" NGINX_ENVSUBST_FILTER='^PORT$' \
+    /docker-entrypoint.sh nginx -g 'daemon off;' &
 nginx=$!
 
 running() {