chore: add nginx deployment smoke test

Add the nginx deployment artifact from PLAN.md. The example config keeps upl
behind nginx, sets client_max_body_size to 64 MiB, disables request buffering for
chunk uploads, forwards standard proxy headers, and leaves explicit placeholders
for TLS certificates and access control before public exposure.

Add just nginx-smoke as a reusable Docker-based verification. The script starts
upl with a temporary data directory, runs nginx as a reverse proxy, uploads a
17 MiB file through nginx, restarts the Rust backend mid-upload, confirms server
progress survives the restart through the proxy, uploads the remaining chunk,
completes the upload, and compares SHA-256 hashes.

Document the production nginx shape, the local Docker smoke-test caveat, and the
manual deployment retest scenario in TESTS.md.

Test Plan:
- bash -n scripts/nginx-smoke.sh
- just check
- just nginx-smoke

Refs: PLAN.md milestone 9

README.md

@@ -25,6 +25,9 @@ upl
     static/index.html  upload tool markup
     static/styles.css  responsive tool styling
     static/app.js      upload scheduler, retries, and browser resume state
+  Deployment
+    deploy/nginx/      nginx reverse proxy example
+    scripts/           reusable local smoke tests
   Validation
     tests/             integration tests for server behavior
     TESTS.md           reusable manual and automated test checklist
@@ -50,3 +53,25 @@ just run
 ```
 
 `just check` also syntax-checks the static browser JavaScript with `node`.
+
+## nginx
+
+Run `upl` on localhost and put nginx in front of it for TLS and access control:
+
+```sh
+UPL_BIND=127.0.0.1:3000 UPL_DATA_DIR=/srv/upl/data upl
+```
+
+Use `deploy/nginx/upl.conf.example` as the starting point for the nginx site.
+Before exposing the service, replace the certificate paths and add a protection
+layer such as HTTP basic auth, an IP allowlist, or VPN-only access.
+
+For a local Docker-based reverse-proxy smoke test:
+
+```sh
+just nginx-smoke
+```
+
+The smoke test binds the Rust server to `0.0.0.0` so the nginx container can
+reach it through Docker's host gateway. The production nginx example keeps the
+server bound to localhost.