Add an nginx version of the /heos proxy

Same contract as the Apache one -- strip the prefix off the request, tell
the app about it with X-Forwarded-Prefix, keep it to the local network --
with the two things nginx needs that Apache did not: a redirect for the
bare /heos, which would otherwise miss the location and fall through to
the filesystem, and the trailing slash on proxy_pass that does the
stripping.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/heos.nginx.conf

@@ -0,0 +1,57 @@
+# HEOS panel behind nginx, at /heos
+#
+#   sudo cp /var/www/html/heos/deploy/heos.nginx.conf /etc/nginx/snippets/heos.conf
+#   then inside the server { } block that serves the site:
+#       include snippets/heos.conf;
+#   sudo nginx -t && sudo systemctl reload nginx
+#
+# nginx reaches the panel on port 5005 (WEB_PORT in config.py). If you want
+# it reachable ONLY through nginx, start it with --host 127.0.0.1; by
+# default it also answers directly on the LAN at <pi-ip>:5005.
+
+# A bare /heos would miss the location below and fall through to the
+# filesystem, so send it to the slashed form first.
+location = /heos {
+    return 301 /heos/;
+}
+
+location /heos/ {
+    # The panel controls the speakers, and it usually hangs off a host
+    # with a public certificate. Keep it to the house unless you mean
+    # otherwise: drop these four lines to let it answer from anywhere.
+    allow 192.168.0.0/24;
+    allow 127.0.0.1;
+    allow ::1;
+    deny all;
+
+    # The trailing slash on proxy_pass is what strips /heos/ back off
+    # before the request reaches the app.
+    proxy_pass http://127.0.0.1:5005/;
+
+    # Tells the app it is mounted on a sub-path, so every link, icon and
+    # fetch it generates is /heos/... rather than /... Without this the
+    # page loads and nothing on it works.
+    proxy_set_header X-Forwarded-Prefix /heos;
+
+    proxy_set_header Host              $host;
+    proxy_set_header X-Real-IP         $remote_addr;
+    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    proxy_http_version 1.1;
+    proxy_set_header Connection "";
+}
+
+# Giving it a host of its own instead? Then it is not on a sub-path, and
+# the X-Forwarded-Prefix line above is the one thing to leave out:
+#
+#   server {
+#       server_name heos.example.com;
+#       location / {
+#           proxy_pass http://127.0.0.1:5005;
+#           proxy_set_header Host              $host;
+#           proxy_set_header X-Real-IP         $remote_addr;
+#           proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+#           proxy_set_header X-Forwarded-Proto $scheme;
+#       }
+#   }