refactor(nginx): overhaul config with dynamic resolution and media serving

- Add Docker DNS resolver to prevent stale upstream IPs after container restarts
- Preserve X-Forwarded-Proto from HAProxy for correct HTTPS detection
- Mount mnemosyne-media volume for direct /media/ serving
- Add IP allowlisting for probe/metrics endpoints (RFC1918 + loopback)
- Fix access_log inheritance so probe paths are properly suppressed
- Expand inline documentation covering routing model and conventions

docker-compose.yaml

@@ -270,6 +270,7 @@ services:
     volumes:
       - ./nginx/mnemosyne.conf:/etc/nginx/conf.d/default.conf:ro
       - mnemosyne-static:/var/www/static:ro
+      - mnemosyne-media:/var/www/media:ro
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost/live/"]
       interval: 30s