ssl on; in every shipped nginx template is a hard startup failure on nginx 1.25+

`ssl on;` appears in all three templates. It was deprecated in nginx 1.15.0 and **removed in 1.25.1** — a config containing it is a hard startup failure on any modern nginx.

This is a landmine under the auto-reload pipeline: the day root2 is upgraded past 1.25, every machine-generated subdomain config becomes unloadable, and there is **no `nginx -t` gate** to catch it. It also means the generated configs can never be validated against a modern nginx.

The same templates also have `ssl_protocols TLSv1.2;` only (no TLS 1.3), a cipher list including non-PFS CBC suites, **no HSTS header anywhere in any repo**, no OCSP stapling, and `client_max_body_size 10G` — a free disk-fill DoS.

On the Django side, `SECURE_HSTS_SECONDS` defaults to `0` and both `SESSION_COOKIE_SECURE` and `CSRF_COOKIE_SECURE` default to **`False`**.

**Fix:** delete `ssl on;` (the `listen 443 ssl` already does the job); `ssl_protocols TLSv1.2 TLSv1.3;`; trim to AEAD suites; add HSTS and the security headers to a shared include; set the three Django flags in the production `.env`; drop `client_max_body_size` to a real limit; add `nginx -t` to the reload script and **verify the gate fails** before trusting it.

---

**Evidence**

```
chakra-docker/nginx/conf.d/chakra_stencil.conf:23-26,37; chakra-backend/confman/config_makers/josh-subdomain_template.txt:24-27; chakra-library/service/nginx/nginx.conf:11-14
```

- Verified against: `origin/master 44ca47e (2026-07-25)`
- Verdict: **CONFIRMED**

Start with the three named nginx templates: chakra-docker/nginx/conf.d/chakra_stencil.conf, chakra-backend/confman/config_makers/josh-subdomain_template.txt, and chakra-library/service/nginx/nginx.conf. Review the Django production .env and reload script, then run nginx -t against generated configurations. Done means modern nginx accepts the templates, the security settings and size limit are applied, and the validation gate catches an invalid configuration.

Written by the indexing model from the issue text.