fix(infra): nginx upstream DNS staleness — 502 after backend restart

- Replace upstream blocks with variable-based proxy_pass + Docker DNS
  resolver (127.0.0.11) so nginx resolves hostnames dynamically on
  each request instead of caching at startup only.
- Add explicit 'docker compose restart proxy' in CI deploy step
  (belt-and-suspenders: also forces nginx restart after deploy).
- Remove no-op sed commands from CI (docker-compose.yml already uses
  GitLab registry, no ghcr.io replacements needed).

Root cause: docker compose up -d only recreates containers whose image
changed. When backend container is recreated (new Docker IP), nginx
still caches the old IP → 502 Bad Gateway on /api/*

.gitlab-ci.yml

@@ -115,15 +115,19 @@ deploy-vps:
         echo '$CI_JOB_TOKEN' | docker login $CI_REGISTRY -u '$CI_REGISTRY_USER' --password-stdin
 
         echo '→ Updating docker-compose image references...'
-        sed -i 's|ghcr.io/\${OWNER:-mytheclipse}|$REGISTRY_PROJECT|g' infra/docker/docker-compose.yml
-        sed -i 's|\${OWNER:-mytheclipse}|$CI_PROJECT_NAMESPACE|g' infra/docker/docker-compose.yml
-
         echo '→ Pulling latest images...'
         docker compose -f infra/docker/docker-compose.yml pull
 
-        echo '→ Restarting containers...'
+        echo '→ Restarting containers (recreates if image changed)...'
         docker compose -f infra/docker/docker-compose.yml up -d --remove-orphans
 
+        # Force restart proxy to pick up new upstream DNS IPs.
+        # Docker's DNS changes when backend/frontend containers are recreated,
+        # but nginx only resolves upstream hostnames at startup. Without this,
+        # nginx keeps pointing to stale container IPs → 502 Bad Gateway.
+        echo '→ Ensuring proxy container is restarted (nginx upstream DNS refresh)...'
+        docker compose -f infra/docker/docker-compose.yml restart proxy
+
         echo '→ Cleaning up...'
         docker image prune -f
         echo '✓ Deploy complete'