- nginx: add strict ciphers+curves, keep TLS1.2/1.3 only
- nginx: route /api,/admin to localhost:8100
- DOCS: mark applied/partial items and next steps
- nginx: route /api and /admin to localhost:8100 (gateway)
- nginx: restrict ssl_protocols to TLSv1.2/TLSv1.3
- gateway: reduce HEALTHCHECK frequency and align health endpoint