fix(canary): prod nginx proxy_pass /api/, /c/, /k/ to canary upstream

Audit F1: prod.nginx had only the SPA fallback so all API requests, trigger
requests, and kubeconfig requests returned index.html, breaking the prod
deployment end-to-end. Added an upstream canary block to nginx.prod.conf and
three proxy_pass location blocks mirroring dev.nginx (plus CF-Connecting-IP
header since prod sits behind Cloudflare Tunnel).

PROJECTS/beginner/canary-token-generator/infra/nginx/nginx.prod.conf

@@ -18,6 +18,11 @@ http {
     include /etc/nginx/mime.types;
     default_type application/octet-stream;
 
+    upstream canary {
+        server canary:8080;
+        keepalive 16;
+    }
+
     limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
     limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
     limit_req_status 429;

PROJECTS/beginner/canary-token-generator/infra/nginx/prod.nginx

@@ -28,6 +28,40 @@ server {
         add_header Content-Type text/plain;
     }
 
+    location /api/ {
+        proxy_pass http://canary;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
+        proxy_read_timeout 30s;
+        limit_req zone=api_limit burst=20 nodelay;
+    }
+
+    location /c/ {
+        proxy_pass http://canary;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
+        proxy_read_timeout 30s;
+    }
+
+    location /k/ {
+        proxy_pass http://canary;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
+        proxy_read_timeout 30s;
+    }
+
     location /assets/ {
         expires 1y;
         add_header Cache-Control "public, immutable";