feat(auth): optional HTTP Basic Auth for the whole site

nginx includes auth_enabled.conf, (re)written at container start from
BASIC_AUTH_USER/PASSWORD (htpasswd via apache2-utils). Both set => the site +
/api require a shared login; unset => open (local dev not locked out). Set both
on the Coolify web service to protect the deployment.

nginx.conf

@@ -4,6 +4,10 @@ server {
   root /usr/share/nginx/html;
   index index.html;
 
+  # Optional HTTP Basic Auth for the whole site (incl. /api). Written at
+  # container start from BASIC_AUTH_USER/PASSWORD; empty file => no auth.
+  include /etc/nginx/auth_enabled.conf;
+
   # Proxy API calls to the backend service (docker-compose service name "api").
   location /api/ {
     proxy_pass http://api:8000;