fix: nix wrappers, path aliases, env config for systemd deployment

- Fix wrapper scripts: shebang at column 0, no $@ expansion
- Fix @/ path alias resolution in compiled JS (tsc doesn't resolve paths)
- Fix nginx log dirs (error_log, access_log, nginx.pid)
- Add correct env files with proper DB password
- Set user:group to gmw for env file access
- Tested: all 3 services active & healthy

infra/nix/nginx.conf.template

@@ -0,0 +1,56 @@
+events {}
+
+http {
+  include @NGINX_MIME@;
+
+  access_log /var/lib/gmw-proxy/nginx-access.log;
+  error_log /var/lib/gmw-proxy/nginx-error.log;
+
+  map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+  }
+
+  server {
+    listen 127.0.0.1:8080;
+    server_name _;
+
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript application/wasm image/svg+xml;
+    gzip_min_length 256;
+
+    location ^~ /api {
+      proxy_pass http://127.0.0.1:3001$uri$is_args$args;
+      proxy_set_header Host              $host;
+      proxy_set_header X-Real-IP         $remote_addr;
+      proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location ^~ /ws {
+      proxy_pass http://127.0.0.1:3001$uri$is_args$args;
+      proxy_http_version 1.1;
+      proxy_set_header Upgrade              $http_upgrade;
+      proxy_set_header Connection           $connection_upgrade;
+      proxy_set_header Host                 $host;
+      proxy_set_header X-Real-IP            $remote_addr;
+      proxy_set_header X-Forwarded-For      $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto    $scheme;
+      proxy_buffering off;
+      proxy_read_timeout 86400s;
+      proxy_send_timeout 86400s;
+    }
+
+    location /assets/ {
+      root @FRONTEND_ROOT@;
+      expires 1y;
+      add_header Cache-Control "public, immutable";
+    }
+
+    location / {
+      root @FRONTEND_ROOT@;
+      index index.html;
+      try_files $uri $uri/ /index.html;
+    }
+  }
+}