Minimal production reverse proxy built on Pingora — TLS, virtual hosting, auth, static files, rate limiting, health checks