nginx config snippet

Build the boring boilerplate. Static site, reverse proxy, HTTPS redirect, gzip + brotli, sane security headers, rate-limit zone.