Upgrade to AlmaLinux 10 and fix WebSocket proxying

Base image moves from AlmaLinux 9 to 10, which forces two related changes:
EPEL repo URL bumps to the el10 release RPM, and tini is replaced with
dumb-init as PID 1 since tini is not packaged in EPEL 10. Both provide the
signal forwarding and zombie reaping the wedged-container fix relies on.
Nginx 1.26 in AlmaLinux 10 deprecates the `listen ... http2` parameter, so
the server block now uses the separate `http2 on;` directive.

Also fixes three issues that affected WebSocket apps (socket.io, ws):

- `Connection: upgrade` was hardcoded on every proxied request, including
  ordinary HTTP. Now driven by a `map $http_upgrade $connection_upgrade`
  so only genuine upgrade requests carry it.
- No explicit proxy read/send timeout meant idle WebSockets were cut at
  nginx's 60s default. Set to 600s, which clears any sane heartbeat without
  pinning connection slots (worker_connections is 512, two per client).
- `large_client_header_buffers 2 1k` returned 400 for any single header
  line over 1KB, which session cookies and bearer tokens routinely exceed.
  Raised to the nginx default of 4 8k; buffers are allocated on demand, so
  this only costs memory for requests that need it.

Verified by rendering the generated config and running it under nginx with
a Node backend: WebSocket handshakes return 101 and reach the upstream
'upgrade' event, polling requests arrive with `Connection: close`, and a
3KB cookie returns 200 where the old buffer setting returned 400.

README gains a WebSocket Support section covering the PM2 cluster-mode
trap, the concurrency ceiling, and reconnects on memory restarts.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -1,6 +1,6 @@
 # Cloud Node Container
 
-This is a base container for running Node.js applications, supporting multiple Node.js versions (18, 20, 22). The default is Node.js 20. The container is based on AlmaLinux 9 and uses Nginx as a reverse proxy with SSL. It is designed for both development and production use.
+This is a base container for running Node.js applications, supporting multiple Node.js versions (18, 20, 22). The default is Node.js 20. The container is based on AlmaLinux 10 and uses Nginx as a reverse proxy with SSL. It is designed for both development and production use.
 
 **You must have Docker or compatible containerization software running.**
 
@@ -164,6 +164,35 @@ The container automatically generates an ecosystem.config.js file from your pack
    });
    ```
 
+### WebSocket Support (socket.io, ws)
+
+WebSockets work out of the box — no configuration needed on your side. Nginx proxies
+upgrade requests through to your app on port 3000, and the auto-generated PM2 config
+runs a **single fork-mode process**, so socket.io's session affinity requirement is
+satisfied automatically. A stock `io.attach(server)` / `new WebSocketServer({ server })`
+setup just works over `wss://your-domain/`.
+
+Things to know before you scale up:
+
+- **Don't switch to PM2 cluster mode.** If you supply your own `ecosystem.config.js`
+  with `exec_mode: 'cluster'` and `instances` greater than 1, socket.io's HTTP
+  long-polling handshake will bounce between workers and clients will see
+  `Session ID unknown` errors. To run multiple instances you need both sticky
+  sessions and a shared adapter (`@socket.io/cluster-adapter` with
+  `@socket.io/sticky`) — the container does not set these up for you.
+- **Concurrency ceiling is roughly 250 simultaneous connections.** Nginx runs one
+  worker with `worker_connections 512`, and each proxied client consumes two slots
+  (browser side plus upstream side). Fine for typical traffic; a limit to plan
+  around for a chat or presence-heavy app.
+- **Keep your heartbeat under 600 seconds.** Nginx closes idle proxied connections
+  after 600s with no data. Socket.io's default `pingInterval` of 25s is well inside
+  this. Only relevant if you deliberately raise it.
+- **Expect reconnects on memory restarts.** PM2 restarts the app at 256MB
+  (`max_memory_restart`), which drops every open socket. Socket.io clients
+  reconnect automatically, but connection state held only in process memory is
+  lost. WebSocket buffers add up — if you hold thousands of connections, watch for
+  restart loops in `logs/nodejs/`.
+
 ### Step 3: Example Applications
 
 See the `examples/` directory for complete working examples:
@@ -201,6 +230,7 @@ When you place your app in `user/app/`, the container automatically:
 - **Multiple Node.js Versions:** 18, 20, 22 (set with `NODEVER` environment variable)
 - **Process Management:** PM2 for production-grade Node.js application management
 - **Reverse Proxy:** Nginx handles SSL termination and proxies requests to Node.js
+- **WebSockets:** socket.io and `ws` supported out of the box (see [WebSocket Support](#websocket-support-socketio-ws))
 - **Automatic Backups:** Application files backed up every 30 minutes in DEV mode
 - **Log Management:** Log rotation compresses logs older than 3 days, deletes after 7 days
 - **Session Storage:** Memcached available in DEV mode for session management