fix(web): stop binding 443 behind the edge SNI router; verify the reload

oolon's TCP 443 belongs to the stream SNI router, which ssl_prereads the
handshake and forwards to the local https tier on 127.0.0.1:14443 with
PROXY protocol. site.conf.tmpl predates that and still bound 443 itself,
so every deploy and every daily refresh rsynced a vhost that collides
with the router.

Nothing in the pipeline caught it. `nginx -t` only detects duplicate
listeners within a context, not across http{} and stream{}, and
`systemctl reload` merely sends SIGHUP, so it exits 0 while nginx logs
"bind() to 0.0.0.0:443 failed (98: Address already in use) ... still
could not bind()", aborts the reconfiguration and keeps its old cycle.
The deploy went green while oolon's running config was frozen. It stayed
frozen for a day, stranding every cert the step@ timers renewed on disk
until eleven internal vhosts were serving expired certs. A cold start
would have failed outright, taking the whole public edge down.

Template the listen line from WEB_LISTEN (manifest web.config.listen for
script/deploy.sh, which renders the same template), and assert that the
reload landed by requiring a fresh worker generation, dumping the nginx
error log when it did not.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0182wzZE8DguMPWhxD21gfP2

script/deploy.sh

@@ -433,10 +433,17 @@ deploy_web() {
     local host="$1"
     log "web -> $host"
 
-    local server_name web_root api_upstream
+    local server_name web_root api_upstream web_listen
     server_name="$(yq --raw-output "${env_path}.components.web.config.server_name" "$manifest")"
     web_root="$(yq    --raw-output "${env_path}.components.web.config.root"        "$manifest")"
     api_upstream="$(yq --raw-output "${env_path}.components.web.config.api_upstream" "$manifest")"
+    # The edge's stream SNI router owns TCP 443; vhosts sit behind it on 14443.
+    # Binding 443 here collides with the router — `nginx -t` passes, but every
+    # later reload aborts while systemctl still reports success. See the
+    # web.config.listen note in asset/manifest.yml.
+    web_listen="$(yq --raw-output "${env_path}.components.web.config.listen" "$manifest")"
+    [[ -n "$web_listen" && "$web_listen" != "null" ]] \
+        || web_listen='127.0.0.1:14443 ssl proxy_protocol'
     [[ -n "$server_name"  && "$server_name"  != "null" ]] || die "web.config.server_name missing in manifest"
     [[ -n "$web_root"     && "$web_root"     != "null" ]] || die "web.config.root missing in manifest"
     [[ -n "$api_upstream" && "$api_upstream" != "null" ]] || die "web.config.api_upstream missing in manifest"
@@ -475,6 +482,7 @@ deploy_web() {
     local rendered
     rendered="$(<"${repo_root}/asset/nginx/site.conf.tmpl")"
     rendered=${rendered//'{{SERVER_NAME}}'/$server_name}
+    rendered=${rendered//'{{WEB_LISTEN}}'/$web_listen}
     rendered=${rendered//'{{DOCROOT}}'/$web_root}
     rendered=${rendered//'{{API_UPSTREAM_SCHEME}}'/$api_upstream_scheme}
     rendered=${rendered//'{{API_UPSTREAM_ADDR}}'/$api_upstream_addr}