fix(docker): stage nginx config from RO source instead of envsubst

[timoa]

Problem

Two layered bugs caused the same symptom:

1. The Dockerfile copied docker/nginx.conf.template to /etc/nginx/templates/default.conf.template, so the base image's 20-envsubst-on-templates.sh entrypoint tried to render it to /etc/nginx/conf.d/default.conf on every container start. Under the chart's readOnlyRootFilesystem: true that write failed with Read-only file system:

   20-envsubst-on-templates.sh: Running envsubst on /etc/nginx/templates/default.conf.template to /etc/nginx/conf.d/default.conf
   20-envsubst-on-templates.sh: line 53: can't create /etc/nginx/conf.d/default.conf: Read-only file system
   

2. Even after removing the template, the emptyDir tmpfs that the chart mounts at /etc/nginx/conf.d was being silently rejected by the kubelet — the template rendered the volume name as etc-nginx-conf.d (with a literal trailing dot from /etc/nginx/conf.d), which is not a valid DNS-1123 label. With the mount rejected, the image's default.conf stayed on the RO layer; 10-listen-on-ipv6-by-default.sh reported can not modify ... read-only file system? and 40-openconcho-config.sh's install failed with File exists (busybox install refuses to overwrite).

The template has no $VAR placeholders, so envsubst adds nothing anyway — the entire template/envsubst mechanism was unnecessary.

Fix

• Dockerfile — ship the config at /etc/openconcho/nginx.conf (outside /etc/nginx/templates/) so 20-envsubst-on-templates.sh finds nothing to render and exits 0.
• docker/40-openconcho-config.sh — cp -f /etc/openconcho/nginx.conf /etc/nginx/conf.d/default.conf (then chmod + chown to match the unprivileged image) at the top of the script. cp -f overwrites any file 10-listen-on-ipv6-by-default.sh may have created earlier in the boot chain.
• charts/openconcho/templates/deployment.yaml — append replace "." "-" to the volume-name pipeline so /etc/nginx/conf.d sanitizes to etc-nginx-conf-d (valid DNS-1123) and the emptyDir actually mounts.
• charts/openconcho/README.md — list /etc/nginx/conf.d in the "Writable paths" row.

The chart's tmpfsMounts: [ /etc/nginx/conf.d, ... ] and fsGroup: 101 settings stay required — kubelet chowns the emptyDir to group 101, then our writes land in the RW tmpfs.

Verification

• helm template now renders all four volumes with valid DNS-1123 names (etc-nginx-conf-d, var-cache-nginx, var-run, tmp); the previous render emitted etc-nginx-conf.d which is invalid.
• make smoke-docker → 8/8 PASS (/api proxy, allowlist, missing-header, reject sentinel)
• Built image openconcho-web:fix2, ran on a plain filesystem: full entrypoint chain (10-listen reports "differs from packaged version" and exits 0, 20-envsubst has no templates and exits 0, 40-openconcho-config.sh overwrites default.conf and writes the resolver + allowlist maps), nginx starts, /healthz returns ok, /api proxy forwards correctly.

Dockerfile                                  |  8 ++++++--
charts/openconcho/README.md                 |  2 +-
charts/openconcho/templates/deployment.yaml |  4 ++--
docker/40-openconcho-config.sh              |  14 ++++++++++----