Upgrade to AlmaLinux 10 and fix WebSocket proxying

Base image moves from AlmaLinux 9 to 10, which forces two related changes:
EPEL repo URL bumps to the el10 release RPM, and tini is replaced with
dumb-init as PID 1 since tini is not packaged in EPEL 10. Both provide the
signal forwarding and zombie reaping the wedged-container fix relies on.
Nginx 1.26 in AlmaLinux 10 deprecates the `listen ... http2` parameter, so
the server block now uses the separate `http2 on;` directive.

Also fixes three issues that affected WebSocket apps (socket.io, ws):

- `Connection: upgrade` was hardcoded on every proxied request, including
  ordinary HTTP. Now driven by a `map $http_upgrade $connection_upgrade`
  so only genuine upgrade requests carry it.
- No explicit proxy read/send timeout meant idle WebSockets were cut at
  nginx's 60s default. Set to 600s, which clears any sane heartbeat without
  pinning connection slots (worker_connections is 512, two per client).
- `large_client_header_buffers 2 1k` returned 400 for any single header
  line over 1KB, which session cookies and bearer tokens routinely exceed.
  Raised to the nginx default of 4 8k; buffers are allocated on demand, so
  this only costs memory for requests that need it.

Verified by rendering the generated config and running it under nginx with
a Node backend: WebSocket handshakes return 101 and reach the upstream
'upgrade' event, polling requests arrive with `Connection: close`, and a
3KB cookie returns 200 where the old buffer setting returned 400.

README gains a WebSocket Support section covering the PM2 cluster-mode
trap, the concurrency ceiling, and reconnects on memory restarts.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/create-nginx-config.sh

@@ -15,7 +15,8 @@ server {
 }
 
 server {
-    listen 443 ssl http2;
+    listen 443 ssl;
+    http2 on;
     server_name $domain $serveralias;
     
     ssl_certificate /etc/pki/tls/certs/localhost.crt;
@@ -30,8 +31,21 @@ server {
     location / {
         proxy_pass http://nodejs_backend;
         proxy_http_version 1.1;
+
+        # WebSocket support (socket.io, ws). \$connection_upgrade is defined by
+        # the map in /etc/nginx/nginx.conf: 'upgrade' when the client asked to
+        # upgrade, 'close' otherwise -- a hardcoded 'upgrade' would send the
+        # header on every ordinary request too.
         proxy_set_header Upgrade \$http_upgrade;
-        proxy_set_header Connection 'upgrade';
+        proxy_set_header Connection \$connection_upgrade;
+
+        # An idle WebSocket sends no bytes, and the default 60s read timeout
+        # would cut it. 600s clears any sane heartbeat (socket.io pings every
+        # 25s by default) without pinning connection slots for an hour --
+        # worker_connections is 512 and each client uses two.
+        proxy_read_timeout 600s;
+        proxy_send_timeout 600s;
+
         proxy_set_header Host \$host;
         proxy_set_header X-Real-IP \$remote_addr;
         proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;

scripts/entrypoint.sh

@@ -97,10 +97,11 @@ tail -F /home/$user/logs/nginx/access.log \
         /home/$user/logs/nodejs/out.log \
         /home/$user/logs/nodejs/error.log 2>/dev/null &
 
-# Start PM2 under tini so it becomes PID 1 (with proper signal forwarding
+# Start PM2 under dumb-init so it becomes PID 1 (with proper signal forwarding
 # and zombie reaping for nginx/crond/memcached children that reparent here).
-# When pm2 exits (e.g. max_restarts exhausted), tini exits and Docker's
+# When pm2 exits (e.g. max_restarts exhausted), dumb-init exits and Docker's
 # restart policy brings the container back.
-echo "Starting PM2 as user $user (under tini as PID 1)..."
+# (dumb-init replaces tini, which is not packaged in EPEL 10.)
+echo "Starting PM2 as user $user (under dumb-init as PID 1)..."
 cd /home/$user/app
-exec tini -- su - $user -c "cd /home/$user/app && NODE_ENV=production pm2 start ecosystem.config.js --no-daemon"
+exec dumb-init -- su - $user -c "cd /home/$user/app && NODE_ENV=production pm2 start ecosystem.config.js --no-daemon"