feat: add comprehensive nginx config test suite

Replaces the obsolete test.sh (which referenced configs/prod.conf,
a file that no longer exists) with 12 static-analysis checks:

  1.  No deprecated TLS versions (TLSv1 / TLSv1.1)
  2.  No duplicate literal server_name values
  3.  Every sites-available conf has a sites-enabled symlink
  4.  No broken symlinks in sites-enabled
  5.  No orphaned sites-enabled symlinks
  6.  No HTTP-only server blocks (port 80 without port 443)
  7.  ssl_certificate / ssl_certificate_key counts match per file
  8.  Plain-HTTP proxy_pass targets are local only
  9.  All SSL cert paths use /etc/letsencrypt/live/
  10. ssl_certificate uses fullchain.pem, key uses privkey.pem
  11. No raw IP addresses as server_name
  12. conf.d contains only expected files

Adds .gitea/workflows/test.yml with two CI jobs: static-analysis
(runs test.sh, no nginx required) and syntax-check (installs
nginx-full, copies config, generates stub SSL certs for all
referenced letsencrypt paths, then runs nginx -t).

.gitea/workflows/test.yml

@@ -0,0 +1,53 @@
+name: Test nginx configuration
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  static-analysis:
+    name: Static Analysis
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Run static analysis
+        run: bash test.sh
+
+  syntax-check:
+    name: nginx Syntax Check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install nginx
+        run: |
+          sudo apt-get update -q
+          sudo apt-get install -y nginx-full
+
+      - name: Deploy config to /etc/nginx
+        run: sudo cp -a nginx/nginx/. /etc/nginx/
+
+      - name: Create stub SSL certificates
+        run: |
+          openssl req -x509 -newkey rsa:2048 -keyout /tmp/stub.key \
+            -out /tmp/stub.pem -days 1 -nodes -subj '/CN=stub'
+
+          while IFS= read -r dir; do
+            sudo mkdir -p "$dir"
+            sudo cp /tmp/stub.pem "$dir/fullchain.pem"
+            sudo cp /tmp/stub.key "$dir/privkey.pem"
+          done < <(grep -rh 'ssl_certificate ' /etc/nginx/sites-available/ \
+            | grep -v '#' \
+            | grep -oP '/etc/letsencrypt/live/[^\s/]+' \
+            | sort -u)
+
+      - name: Run nginx syntax check
+        run: sudo nginx -t