Upgrade to AlmaLinux 10 and fix WebSocket proxying

Base image moves from AlmaLinux 9 to 10, which forces two related changes:
EPEL repo URL bumps to the el10 release RPM, and tini is replaced with
dumb-init as PID 1 since tini is not packaged in EPEL 10. Both provide the
signal forwarding and zombie reaping the wedged-container fix relies on.
Nginx 1.26 in AlmaLinux 10 deprecates the `listen ... http2` parameter, so
the server block now uses the separate `http2 on;` directive.

Also fixes three issues that affected WebSocket apps (socket.io, ws):

- `Connection: upgrade` was hardcoded on every proxied request, including
  ordinary HTTP. Now driven by a `map $http_upgrade $connection_upgrade`
  so only genuine upgrade requests carry it.
- No explicit proxy read/send timeout meant idle WebSockets were cut at
  nginx's 60s default. Set to 600s, which clears any sane heartbeat without
  pinning connection slots (worker_connections is 512, two per client).
- `large_client_header_buffers 2 1k` returned 400 for any single header
  line over 1KB, which session cookies and bearer tokens routinely exceed.
  Raised to the nginx default of 4 8k; buffers are allocated on demand, so
  this only costs memory for requests that need it.

Verified by rendering the generated config and running it under nginx with
a Node backend: WebSocket handshakes return 101 and reach the upstream
'upgrade' event, polling requests arrive with `Connection: close`, and a
3KB cookie returns 200 where the old buffer setting returned 400.

README gains a WebSocket Support section covering the PM2 cluster-mode
trap, the concurrency ceiling, and reconnects on memory restarts.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

configs/nginx.conf

@@ -15,8 +15,20 @@ http {
     client_body_buffer_size 16k;
     client_header_buffer_size 1k;
     client_max_body_size 8m;
-    large_client_header_buffers 2 1k;
-    
+    # Buffers are allocated on demand, so the larger size only costs memory for
+    # requests that actually need it. 1k rejected any single header line over
+    # 1KB with a 400 -- session cookies and Authorization bearer tokens
+    # routinely exceed that.
+    large_client_header_buffers 4 8k;
+
+    # Maps the Connection header sent upstream to whether the client actually
+    # requested an upgrade. Used by conf.d/default.conf so WebSocket handshakes
+    # (socket.io, ws) upgrade while ordinary requests keep normal semantics.
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
     # Real IP configuration for HAProxy
     set_real_ip_from 10.0.0.0/8;     # Private network range
     set_real_ip_from 172.16.0.0/12;  # Private network range