Use the shared edge nginx instead of Musify's own

Remove deploy/nginx and the nginx service from compose.prod.yml: the
shared edge in Infrastructure owns ports 80/443 and serves every
domain. Make the deploy job fail when zitadel-init or seaweedfs-init
fail, and document the runner and edge setup.

deploy/.env.prod.example

@@ -7,8 +7,8 @@
 #      subdomains),
 #   2. replace every CHANGE_ME with a strong random value
 #      (`openssl rand -hex 24`),
-#   3. point each *_DOMAIN below at the server, proxied/TLS-terminated the
-#      same way.
+#   3. point each domain below at the server and add its vhost to the shared
+#      edge (Infrastructure's edge/conf.d).
 #
 # Requires ../../../Infrastructure running first, on the same Docker host,
 # with its own `infra-net` network already created. See
@@ -18,14 +18,9 @@
 DOTNET_ENVIRONMENT=Production
 
 # --- Domains -------------------------------------------------------------
-# Each *_DOMAIN drives its own nginx vhost (deploy/nginx/templates); the
-# PUBLIC_*_URL/S3_PUBLIC_URL below must agree with it (https://<domain>).
-WEB_DOMAIN=musify.example.com
-API_DOMAIN=musifyapi.example.com
-STREAM_DOMAIN=musifystream.example.com
-AUTH_DOMAIN=auth.example.com
-S3_DOMAIN=s3.example.com
-
+# Public URLs. They must match the vhosts of the shared edge nginx
+# (Infrastructure's edge/conf.d), which is what serves them; the domains are
+# independent, they don't need to share a root.
 PUBLIC_WEB_URL=https://musify.example.com
 PUBLIC_API_URL=https://musifyapi.example.com
 PUBLIC_STREAM_URL=https://musifystream.example.com
@@ -71,6 +66,4 @@ SESSION_SECRET=CHANGE_ME
 AUTH_ALLOW_INSECURE_HTTP=false
 
 # --- Misc --------------------------------------------------------------------
-AUTH_REQUIRE_HTTPS=true
-# Largest request body nginx accepts (audio uploads go through the web player).
-MAX_UPLOAD_SIZE=1024m
+AUTH_REQUIRE_HTTPS=true