fix: forward websocket upgrade headers for forms.nhcarrigan.com, sync hisho.nhcarrigan.com block and cloudflare ip refresh from server

nginx/nginx/cloudflare_ips.conf

@@ -1,5 +1,5 @@
 # Auto-generated Cloudflare IP ranges
-# Updated: Wed Jun 10 10:59:21 PM PDT 2026
+# Updated: Wed Jul  8 11:01:39 PM PDT 2026
 
 real_ip_header CF-Connecting-IP;
 

nginx/nginx/sites-available/ai.conf

@@ -17,3 +17,22 @@ server {
   }
   include /etc/nginx/snippets/deny-dotfiles.conf;
 }
+
+server {
+  listen 443 ssl;
+  server_name hisho.nhcarrigan.com;
+  ssl_certificate /etc/letsencrypt/live/hisho.nhcarrigan.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/hisho.nhcarrigan.com/privkey.pem;
+
+  location / {
+    proxy_pass http://127.0.0.1:44124;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+  include /etc/nginx/snippets/deny-dotfiles.conf;
+}

nginx/nginx/sites-available/forms.conf

@@ -156,6 +156,8 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header Host $http_host;
         proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
         proxy_pass http://127.0.0.1:11111;
         proxy_redirect off;
     }