Fix Contracts upload buffer endpoint

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

deploy/contracts-upload-cleanup.cron

@@ -0,0 +1,2 @@
+# Remove abandoned temporary upload objects after 30 minutes.
+*/5 * * * * root find /var/www/contracts-upload/ -type f -mmin +30 -delete

deploy/nginx-contracts-upload-acme.conf

@@ -0,0 +1,16 @@
+# Temporary HTTP-only vhost for the initial Let's Encrypt HTTP-01 challenge.
+# Install as /etc/nginx/sites-enabled/contracts-upload.conf, issue the
+# certificate, then replace it with nginx-contracts-upload.conf.
+
+server {
+    listen 80;
+    server_name contracts-upload.sinefo.ru;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/acme;
+    }
+
+    location / {
+        return 404;
+    }
+}

deploy/nginx-contracts-upload.conf

@@ -0,0 +1,50 @@
+# Dedicated WebDAV upload buffer for Contracts on VM213.
+# Install as /etc/nginx/sites-enabled/contracts-upload.conf.
+
+# sites-enabled is included from Nginx's http context, where map is valid.
+map $http_origin $contracts_upload_cors_origin {
+    default "";
+    ~^https://contractor\.pythonk8s\.dev\.nubes\.ru$ $http_origin;
+}
+
+server {
+    listen 80;
+    server_name contracts-upload.sinefo.ru;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/acme;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name contracts-upload.sinefo.ru;
+
+    ssl_certificate /etc/letsencrypt/live/contracts-upload.sinefo.ru/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/contracts-upload.sinefo.ru/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    # Match the app's 50 MiB per-file limit; uploads are raw PUT bodies.
+    client_max_body_size 50m;
+
+    location /contracts-upload/ {
+        alias /var/www/contracts-upload/;
+        dav_methods PUT DELETE;
+        create_full_put_path on;
+        client_max_body_size 50m;
+        add_header Access-Control-Allow-Origin $contracts_upload_cors_origin always;
+        add_header Access-Control-Allow-Methods "PUT, GET, OPTIONS, DELETE" always;
+        add_header Access-Control-Allow-Headers "Content-Type" always;
+        add_header Access-Control-Max-Age 86400 always;
+        if ($request_method = OPTIONS) { return 204; }
+    }
+
+    location / {
+        return 404;
+    }
+}

deploy/nginx-contracts.conf

@@ -92,22 +92,6 @@ server {
         client_max_body_size 100m;
     }
 
-    # ── VM-буфер загрузки contracts (паттерн drhider) ──────────────
-    # Браузер кладёт файл сюда PUT (мимо шлюза кластера ~64КБ), бэк тянет сам.
-    # Файлы: /var/www/contracts-upload/ (нужно создать, chown www-data).
-    # CORS: origin фронтенда = contractor.pythonk8s.dev.nubes.ru (ingress, подтверждено).
-    location /contracts-upload/ {
-        alias /var/www/contracts-upload/;
-        dav_methods PUT DELETE;
-        create_full_put_path on;
-        client_max_body_size 1024m;
-        add_header Access-Control-Allow-Origin https://contractor.pythonk8s.dev.nubes.ru always;
-        add_header Access-Control-Allow-Methods 'PUT, GET, OPTIONS, DELETE' always;
-        add_header Access-Control-Allow-Headers 'Content-Type' always;
-        add_header Access-Control-Max-Age 86400 always;
-        if ($request_method = OPTIONS) { return 204; }
-    }
-
     listen 443 ssl; # managed by Certbot
     ssl_certificate /etc/letsencrypt/live/contracts.kube5s.ru/fullchain.pem; # managed by Certbot
     ssl_certificate_key /etc/letsencrypt/live/contracts.kube5s.ru/privkey.pem; # managed by Certbot