fix(nginx): stop rate-limiting the frontend bundle into a blank page

Loading the panel over the domain produced a white page while the same
panel served directly from the frontend container rendered fine. The built
SPA requests 86 files on a cold load — one entry module plus 85 preloaded
chunks — and the server-level

    limit_req zone=general burst=20 nodelay;   # general = 10r/s

applies to those static assets too. Measured against the live site, 60 of
the 86 came back 503 and nginx logged "limiting requests ... by zone
general" for each. The entry module was among the casualties, so React
never booted and the document stayed empty.

Give static assets their own zone and restate the limit in a location that
matches them. The limit has to be restated rather than omitted: nginx
inherits limit_req from the enclosing level only when a location declares
none, and there is no `limit_req off`.

Both templates get the block, since the non-SSL config serves the same
bundle. Verified on the live deployment: 86/86 assets now return 200 and
the login page renders with no console errors.

nginx/conf.d/pvemanager-nossl.conf.template

@@ -67,6 +67,22 @@ server {
         proxy_send_timeout 86400;
     }
 
+    # Frontend build output. A cold load of the SPA requests ~86 files at once,
+    # which the server-level limit_req rejects with 503 — leaving a blank page.
+    # The limit has to be restated here rather than omitted: nginx inherits
+    # limit_req from the server level only when a location declares none.
+    location ~ ^/(assets/|favicon\.|icons\.svg|logo\.png) {
+        limit_req zone=static burst=200 nodelay;
+        proxy_pass http://pvemanager-frontend:80;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
     # Backend static files (legacy, logo, etc.)
     location /static/ {
         proxy_pass http://pvemanager-app:8000;

nginx/conf.d/pvemanager.conf.template

@@ -97,6 +97,22 @@ server {
         proxy_send_timeout 86400;
     }
 
+    # Frontend build output. A cold load of the SPA requests ~86 files at once,
+    # which the server-level limit_req rejects with 503 — leaving a blank page.
+    # The limit has to be restated here rather than omitted: nginx inherits
+    # limit_req from the server level only when a location declares none.
+    location ~ ^/(assets/|favicon\.|icons\.svg|logo\.png) {
+        limit_req zone=static burst=200 nodelay;
+        proxy_pass http://pvemanager-frontend:80;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
     # Backend static files (legacy, logo, etc.)
     location /static/ {
         proxy_pass http://pvemanager-app:8000;

nginx/nginx.conf

@@ -46,6 +46,9 @@ http {
     # Rate limiting
     limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
     limit_req_zone $binary_remote_addr zone=api:10m rate=30r/s;
+    # The built frontend pulls ~86 files in one burst on a cold load, so static
+    # assets need their own budget — the general zone rejects them outright.
+    limit_req_zone $binary_remote_addr zone=static:10m rate=200r/s;
     limit_conn_zone $binary_remote_addr zone=addr:10m;
 
     # Include site configurations