nginx: listen on PORT, default 8080; server_tokens off (closes #26)

nginx.conf is now a template the nginx image renders into conf.d at
container start. bin/entrypoint.sh gives nginx PORT, 8080 when unset or
empty, and limits the rendering to PORT with NGINX_ENVSUBST_FILTER, so
$uri, $host and every other nginx variable pass through unchanged. A
PORT nginx cannot listen on stops the container non-zero.
server_tokens off drops the version from the Server header and error
pages. script/frontend-viewport-test renders the template the same way.
EXPOSE still documents 8080; the backend stays on 127.0.0.1:8081.

Model: opus-5-5

script/frontend-viewport-test

@@ -61,10 +61,13 @@ main() {
     # host.
     docker network create --internal "$NETWORK" > /dev/null
 
+    # nginx.conf is a template: the image renders it over its own
+    # default.conf, with the same port and limit bin/entrypoint.sh uses.
     docker run -d --rm --name "$SERVER" \
         --network "$NETWORK" --network-alias netwatch \
+        -e PORT=8080 -e NGINX_ENVSUBST_FILTER='^PORT$' \
         -v "$ROOT/dist:/usr/share/nginx/html:ro" \
-        -v "$ROOT/nginx.conf:/etc/nginx/conf.d/default.conf:ro" \
+        -v "$ROOT/nginx.conf:/etc/nginx/templates/default.conf.template:ro" \
         "$SERVER_IMAGE" > /dev/null
 
     # The image's own entrypoint already exposes CDP on 9222 and passes