refactor: restructure nginx config into per-app files (#1)

## Summary

- Added `push.sh` script to deploy configs to prod via `sudo rsync` (with `--delete` for exact mirroring)
- Split the monolithic `conf.d/server.conf` (1,682 lines, 96 server blocks) into 28 per-app files under `sites-available/`, with corresponding symlinks in `sites-enabled/`
- Extracted custom `nginx.conf` settings (`log_format` directives, `server_names_hash_bucket_size`) into dedicated `conf.d/logging.conf` and `conf.d/tuning.conf` files, leaving `nginx.conf` as close to stock as possible

## Test plan

- [x] `sudo nginx -t` passes on prod after the sites-available restructure

✨ This PR was created with help from Hikari~ 🌸

Co-authored-by: Naomi Carrigan <commits@nhcarrigan.com>
Reviewed-on: #1
Co-authored-by: Hikari <hikari@nhcarrigan.com>
Co-committed-by: Hikari <hikari@nhcarrigan.com>

.gitea/workflows/test.yml

@@ -0,0 +1,53 @@
+name: Test nginx configuration
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  static-analysis:
+    name: Static Analysis
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Run static analysis
+        run: bash test.sh
+
+  syntax-check:
+    name: nginx Syntax Check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install nginx
+        run: |
+          sudo apt-get update -q
+          sudo apt-get install -y nginx-full
+
+      - name: Deploy config to /etc/nginx
+        run: sudo cp -a nginx/nginx/. /etc/nginx/
+
+      - name: Create stub SSL certificates
+        run: |
+          openssl req -x509 -newkey rsa:2048 -keyout /tmp/stub.key \
+            -out /tmp/stub.pem -days 1 -nodes -subj '/CN=stub'
+
+          while IFS= read -r dir; do
+            sudo mkdir -p "$dir"
+            sudo cp /tmp/stub.pem "$dir/fullchain.pem"
+            sudo cp /tmp/stub.key "$dir/privkey.pem"
+          done < <(grep -rh 'ssl_certificate ' /etc/nginx/sites-available/ \
+            | grep -v '#' \
+            | grep -oP '/etc/letsencrypt/live/[^\s/]+' \
+            | sort -u)
+
+      - name: Run nginx syntax check
+        run: sudo nginx -t