Move behind nginx reverse proxy: app binds 127.0.0.1:4567, nginx owns :80

Avoids the cap_net_bind_service dance breaking on every RVM ruby patch
upgrade (it happened today after today's ruby-4.0.7 install).

nginx-labelprint.conf

@@ -0,0 +1,20 @@
+# Installed at /etc/nginx/sites-available/labelprint on rpi-printserver
+# (symlinked into sites-enabled), not auto-deployed -- kept here just so a
+# reflash/rebuild isn't a guessing game. nginx owns :80 so the app itself
+# never needs cap_net_bind_service (which a plain RVM ruby patch upgrade
+# silently drops, since it's tied to the old binary's path).
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name rpi-printserver.hv.priesol.net;
+
+    client_max_body_size 20m;
+
+    location / {
+        proxy_pass http://127.0.0.1:4567;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}